- Fixed bug #49687 (utf8_decode vulnerabilities and deficiencies in the number
of reported malformed sequences). (Gustavo)
#Made a public interface for get_next_char/utf-8 in trunk to use i

- Fixed bug #49687 (utf8_decode vulnerabilities and deficiencies in the number
of reported malformed sequences). (Gustavo)
#Made a public interface for get_next_char/utf-8 in trunk to use in utf8_decode.
#In PHP 5.3, trunk's get_next_char was copied to xml.c because 5.3's
#get_next_char is different and is not prepared to recover appropriately from
#errors.

show more ...

- Completed rewrite of html.c. Except for determine_charset, almost nothing
remains.
- Fixed bug on determine_charset that was preventing correct detection in
combination with interna

- Completed rewrite of html.c. Except for determine_charset, almost nothing
remains.
- Fixed bug on determine_charset that was preventing correct detection in
combination with internal mbstring encoding "none", "pass" or "auto".
- Added profiles for entity encode/decode for HTMl 4.01, XHTML 1.0, XML 1.0
and HTML 5. Added the constants ENT_HTML401, ENT_XML1, ENT_XHTML and
ENT_HTML5.
- htmlentities()/htmlspecialchars(), when told not to double encode, verify
the correctness of the existenting entities more thoroughly.
It is checked whether the numerical entity represents a valid unicode code
point (number is between 0 and 0x10FFFF). If using the flag ENT_DISALLOWED,
it is also checked whether that numerical entity is valid in selected
document. In HTML 4.01, all the numerical entities that represent a Unicode
code point (< U+10FFFFFF) are valid, but that's not the case with other
document types. If the entity is not valid, & is encoded to &amp;.
For named entities, the check is also more thorough. While before the only
check would be to determine if the entity was constituted by alphanumeric
characters, now it is checked whether that entity is necessarily defined for
the target document type. Otherwise, & is encoded to &amp;.
- For html_entity_decode(), only valid numerical and named entities (as defined
above for htmlentities()/htmlspecialchars() + !double_encode) are decoded.
But there is in this case one additional check. Entities that represent
non-SGML or otherwise invalid characters are not decoded. Note that, in
HTML5, U+000D is a valid literal character, but the entity &#x0D is not
valid and is therefore not decoded.
- The hash tables lazily created for decoding in html_entity_decode() that were
added recently were substituted by static hash tables. Instead of 1 hash
table per encoding, there's only one hash table per document type defined in
terms of unicode code points. This means that for charsets other than UTF-8
and ISO-8859-1, a conversion to unicode code points is necessary before
decoding.
- On the encoding side, the ad hoc ranges of entities of the translation
tables, which mapped (in general) non-unicode code points to HTML entities
were replaced by three-stage tables for HTML 4 and HTML 5. This mapping
tables are defined only in terms of unicode code points, so a conversion
is necessary for charsets other than UTF-8 and ISO-8859-1. Even so, the
multi-stage table is much faster than the previous method, by a factor
of 5; the conversion to unicode is a small penalty because it's just a
simple table lookup.
XML 1.0/htmlspecialchars() uses a simple table instead of a three-stage
table.
- Added the flag ENT_SUBSTITUTE, which makes htmlentities()/htmlspecialchars()
replace the invalid multibyte sequences with U+FFFD (UTF-8) or &#FFFD;
(other encodings).
- Added the flag ENT_DISALLOWED. Implements FR #52860. Characters that cannot
appear literally are replaced by U+FFFD (UTF-8) or &#FFFD; (otherwise).
An alternative implementation would be to encode those characters into
numerical entities, but that would only work in HTML 4.01 due to limitations
on the values of numerical entities in other document types. See also the
effects on htmlentities()/htmlspecialchars() with !double_encode above.

show more ...

sed -i "s#1997-2009#1997-2010#g" **/*.c **/*.h **/*.php

MFH: Bump copyright year, 3 of 3.

MFH: Added ENT_IGNORE as a compatibility flag for htmlentities() and
htmlspecialchars() to skip multibyte sequences intead of returning an
empty string (as iconv's //IGNORE). These functions

MFH: Added ENT_IGNORE as a compatibility flag for htmlentities() and
htmlspecialchars() to skip multibyte sequences intead of returning an
empty string (as iconv's //IGNORE). These functions will still never
return an invalid or incomplete multibyte sequence.
Fixes #43896

show more ...

MFH: Bump copyright year, 2 of 2.

[DOC] Added a 4th parameter flag to htmlspecialchars() and htmlentities()
that makes the function not encode existing html entities. The feature is
disabled by default and can be activated by

[DOC] Added a 4th parameter flag to htmlspecialchars() and htmlentities()
that makes the function not encode existing html entities. The feature is
disabled by default and can be activated by passing FALSE as the 4th param

show more ...

MFH: Bump year.

add php_unescape_html_entities() proto to the header
(fixes #39665)

bump year and license version

- Bumber up year

Added htmlspecialchars_decode() function for fast conversion from
htmlspecialchars() generated entities back to characters.

- Happy new year and PHP 5 for rest of the files too..
# Should the LICENSE and Zend/LICENSE dates be updated too?

updating license information in the headers.

Bump year.

Fix ZTS build.

* formatting, plus remove some old fopen wrappers

New PHP streams...

Maintain headers.

Update headers.

Added charset awareness to htmlentities() and htmlspecialchars(); use an
optional third parameter to specify the charset; otherwise tries to determine
it from the LC_CTYPE locale setting.

* Made ENT_* defines availabe to other functions.
* The key/variable names in WDDX are now html escaped to not break XML.
@- Fixed WDDX serialization to HTML-escape key/variable names so as n

* Made ENT_* defines availabe to other functions.
* The key/variable names in WDDX are now html escaped to not break XML.
@- Fixed WDDX serialization to HTML-escape key/variable names so as not to
@ break the XML packet. (Andrei)

show more ...

- Fix copyright notices with 2001

Clean up htmlspecialchars/htmlentities inconsistencies.
@Clean up htmlspecialchars/htmlentities inconsistencies. (Rasmus)

Changed lots of PHP 3 licence headers to PHP 4, mainly in .h files.
Added a few RCS $Id$ tags.

# Note: I have avoided changing any .h files if the corresponding .c file
# had not alr

Changed lots of PHP 3 licence headers to PHP 4, mainly in .h files.
Added a few RCS $Id$ tags.

# Note: I have avoided changing any .h files if the corresponding .c file
# had not already been changed as I am not sure if there are any legal
# issues here. So some extensions still have PHP 3 headers.

show more ...