Description:
------------
We had a conversation on the google group as follows, relating to the possibility of generating xml without the necessary escaping:


Hi Caroline,
well spotted. There are places in both the wsdl generation and in the xmlrpc binding that we generate xml by simply sticking strings together ( I searched for "</" ).

We should probably edit the variables that we are using to make sure they don't contain dodgy characters. I think they are only ever values that we pull out of the annotations e.g. from @param and so forth, but we should be careful. I will raise a pecl bug to track it. 

Matthew

On Nov 23, 4:33 pm, Caroline Maynard <c...@php.net> wrote:
> Caroline Maynard wrote:
> > Caroline Maynard wrote:
> > Matthew, I see you've found a Tuscany problem
> > (http://issues.apache.org/jira/browse/TUSCANY-1553) already open for
> > this. Even if that gets fixed though, I don't think we can always depend
> > on Tuscany - the SCA code generates some xml itself in places, does it
> > not? - so we have to be prepared with the htmlentities($in, ENT_QUOTES)
> > or its internal equivalent, I think.
> 
> ... but not substituting within CDATA sections, of course ...