> For as far as I can see, xml_* is based on expat.

Originally, indeed.  However, it is usually build against libxml2
nowadays.

> Html with an invalid attribute should make xml_parse return 0,
> instead of 1

ACK.  And it does, if you pass TRUE to the $is_final parameter;
otherwise at least the libxml2 based extension still waits for
further input, and does not signal an error.  So the fixed and
enhanced test script would be:

    <?php
    $p = xml_parser_create('UTF-8');
    $html = '<img src="http://i.mg/" title="a\"b" />';
    var_dump(xml_parse($p, $html, true));
    var_dump(xml_error_string(xml_get_error_code($p)));

The actual result will be:

    int(0)
    string(10) "> required"

The documentation[1] already states:

| Entity errors are reported at the end of the data thus only if
| is_final is set and TRUE.

This should be generalized wrt. this issue.

[1] <http://www.php.net/manual/en/function.xml-parse.php#refsect1-function.xml-parse-returnvalues>

This bug has been fixed in the documentation's XML sources. Since the
online and downloadable versions of the documentation need some time
to get updated, we would like to ask you to be a bit patient.

Thank you for the report, and for helping us make our documentation better.