php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #78003 strip_tags output change since PHP 7.3
Submitted: 2019-05-11 12:27 UTC Modified: 2019-05-12 14:12 UTC
From: alex at buayacorp dot com Assigned: cmb (profile)
Status: Closed Package: Strings related
PHP Version: 7.3.5 OS:
Private report: No CVE-ID: None
 [2019-05-11 12:27 UTC] alex at buayacorp dot com
Description:
------------
While doing the migration from PHP 7.2 to PHP 7.3, we noticed an output change of strip_tags which broke some text parsing related code in our application. Since the release notes from PHP 7.3 only mentions the deprecation of strip tags stream filtering [1], we are wondering if this output change was an intended or not.

You can see the different output in https://3v4l.org/lE5Vb

[1] https://php.net/manual/en/migration73.deprecated.php#migration73.deprecated.core.strip-tags-streaming

Test script:
---------------
<?php

$s=<<<FOO
<script>if (i<j.length);</script>
hola<a href="foo">demo</a>
<script>
/* <![CDATA[ */

/* ]]> */
if(a>2);
</script>
demo
bar
FOO;

var_dump(strip_tags( $s, '<a>' ));

Expected result:
----------------
string(18) "if (i2);

demo
bar"

Actual result:
--------------
string(26) "if (i */
if(a2);

demo
bar"

Patches

Add a Patch

Pull Requests

Pull requests:

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-05-12 00:00 UTC] cmb@php.net
Looks like the behavior has changed as of commit 5cf6474[1].

[1] <http://git.php.net/?p=php-src.git;a=commit;h=5cf64742773ddbf9af69d962a4d12b567fcf0084>
 [2019-05-12 14:12 UTC] cmb@php.net
-Package: *General Issues +Package: Strings related -Assigned To: +Assigned To: cmb
 [2019-05-12 14:12 UTC] cmb@php.net
Simpler reproducer:

    <?php
    var_dump(
        strip_tags('<foo<>bar>'),
        strip_tags('<foo<!>bar>')
    );
    ?>

PHP 7.2 outputs:

    string(0) ""
    string(0) ""

PHP 7.3 outputs:

    string(0) ""
    string(3) "bar"

However, whether there's an exclamation mark or not shouldn't make
a difference.
 [2019-05-12 14:12 UTC] cmb@php.net
The following pull request has been associated:

Patch Name: Fix #78003: strip_tags output change since PHP 7.3
On GitHub:  https://github.com/php/php-src/pull/4153
Patch:      https://github.com/php/php-src/pull/4153.patch
 [2019-05-13 11:12 UTC] cmb@php.net
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=69bab6e5a5c8afba684b5fbde6e005a47408d01e
Log: Fix #78003: strip_tags output change since PHP 7.3
 [2019-05-13 11:12 UTC] cmb@php.net
-Status: Assigned +Status: Closed
 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Tue Jul 23 18:01:25 2019 UTC