php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Doc Bug #71577 filter_var / FILTER_SANITIZE_FULL_SPECIAL_CHARS differs from htmlspecialchars
Submitted: 2016-02-12 16:08 UTC Modified: 2021-06-10 11:43 UTC
From: stheine at arcor dot de Assigned:
Status: Verified Package: Filter related
PHP Version: 5.6.18 OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: stheine at arcor dot de
New email:
PHP Version: OS:

 

 [2016-02-12 16:08 UTC] stheine at arcor dot de
Description:
------------
documentation ( http://php.net/manual/en/filter.filters.sanitize.php ) states:

filter_var, option FILTER_SANITIZE_FULL_SPECIAL_CHARS: Equivalent to calling htmlspecialchars() with ENT_QUOTES set.
but in reality, the two differ.

the FILTER_SANITIZE_FULL_SPECIAL_CHARS is missing the FILTER_FLAG_ENCODE_AMP flag (which is not even documented for that filter) to actually be equivalent to htmlspecialchars() as documented.

Test script:
---------------
$STRING = "1 2";
echo htmlspecialchars($STRING, ENT_QUOTES)."\n".
     filter_var($STRING, FILTER_SANITIZE_FULL_SPECIAL_CHARS)."\n";

1 2
1 2

Expected result:
----------------
following the documentation, I expect 

filter_var("1 2", FILTER_SANITIZE_FULL_SPECIAL_CHARS)

to return

1 2

Actual result:
--------------
1 2

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-06-10 11:41 UTC] cmb@php.net
-Status: Open +Status: Verified
 [2021-06-10 11:41 UTC] cmb@php.net
Well, FILTER_SANITIZE_FULL_SPECIAL_CHARS is actually equivalent to

    htmlentities($string, ENT_QUOTES, ini_get('default_charset'), false)

See <https://3v4l.org/PStra>.  Note that $double_encode is off,
and that it's htmlentities() and not htmspecialchars().

> the FILTER_FLAG_ENCODE_AMP flag (which is not even documented
> for that filter)

Right, that should be added.

But frankly, I don't understand why anybody would want to use that
filter on input.  HTML escaping should be done on output, IMHO.
 [2021-06-10 11:43 UTC] cmb@php.net
-Type: Bug +Type: Documentation Problem
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed Dec 04 19:01:32 2024 UTC