htmlspecialchars_decode() ENT_SUBSTITUTE flag has no effect #9582

Activity

1. lucaswerkmeister

   added

   Bug

   Status: Needs Triage

   on Sep 20, 2022
2. lucaswerkmeister commented on Sep 20, 2022

   

   lucaswerkmeister

   on Sep 20, 2022

   Author

   More actions

   (The code example assumes UTF-8. substr( 'abcdeä', 0, 6 ) might not produce an incomplete code unit sequence under other encodings.)
3. hormus commented on Sep 24, 2022

   

   hormus

   on Sep 24, 2022

   Last edited by hormus

   More actions

   There is no encoding parameter in htmlspecialchars_decode and therefore ENT_SUBSTITUTE cannot be applied.
   If you don't know your input string you will have to validate with htmlspecialchars and after htmlspecialchars_decode

   <?php
   
   $hexstring = "\x61\x62\x63\x64\x65\xC3";
   $output1 = htmlspecialchars( substr( $hexstring, 0, 6 ), ENT_SUBSTITUTE, 'UTF-8' ); //abcde(U+FFFD EF BF BD) 
   $output2 = htmlspecialchars_decode( $output1, ENT_SUBSTITUTE );
   var_dump( $output1, $output2 );
   
   ?>

   Example 2:

   <?php
   
   ob_start();
   ini_set( 'default_charset', 'EUC-JP' );
   header( 'Content-Type: text/plain; charset=EUC-JP' );
   ob_end_clean();
   $hexstring = "\x61\x62\x63\x64\x65\xC3";
   $output1 = htmlspecialchars( substr( $hexstring, 0, 6 ), ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, 'UTF-8' ); //abcde(U+FFFD EF BF BD) validate input hexstring
   $output2 = htmlspecialchars_decode( $output1 ); //decode
   $output2 = htmlspecialchars( $output2, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, 'EUC-JP' ); //convert from UTF-8 to EUC-JP
   $output2 = htmlspecialchars_decode( $output2 );
   var_dump( urlencode( $output1 ), urlencode( $output2 ) );
   
   ?>

   Expected result:

   string(14) "abcde%EF%BF%BD"
   string(25) "abcde%EF%BF%26%23xFFFD%3B"