php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #37601 SimpleXML and loss of entities
Submitted: 2006-05-26 12:12 UTC Modified: 2008-03-22 22:26 UTC
Votes:3
Avg. Score:4.0 ± 0.8
Reproduced:3 of 3 (100.0%)
Same Version:1 (33.3%)
Same OS:1 (33.3%)
From: php at nineberry dot de Assigned:
Status: Closed Package: SimpleXML related
PHP Version: 5.1.4 OS: probably irrelevant
Private report: No CVE-ID: None
 [2006-05-26 12:12 UTC] php at nineberry dot de
Description:
------------
When assigning values to node parameters, entities are not escaped, however when reading values, the entities are replaced by their meaning.

i.e. assigning and reading behave assymetric.

Suggestion: Add escaping of values that are assigned.

Kind of workaround: Use htmlspecialchars() manually on values before assigning. (This workaround will not work for ')

Reproduce code:
---------------
<?php
$rawxml = '<root par="F" />';
$test = 'A &quot; B';

$rr = simplexml_load_string($rawxml);

header("Content-Type: text/plain");

echo($rr["par"]);
echo("\n");
echo("\n");

$rr["par"] = $test;

echo($rr->asXML());
echo("\n");

echo($rr["par"]);
echo("\n");
?>

Expected result:
----------------
F

<?xml version="1.0"?>
<root par="A &quot;quot; B"/>

A &quot; B

Actual result:
--------------
F

<?xml version="1.0"?>
<root par="A &quot; B"/>

A " B

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-05-26 22:07 UTC] helly@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5.2-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php5.2-win32-latest.zip
 [2006-06-03 01:00 UTC] php-bugs at lists dot php dot net
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2008-03-19 13:36 UTC] php at nineberry dot de
No longer reproducable in PHP 5.2.5
So this was fixed sometime between 5.1.4 and 5.2.5
 [2008-03-22 22:26 UTC] johannes@php.net
MArk as closed then.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 25 00:01:41 2024 UTC