[wp-trac] [WordPress Trac] #17780: Use PHP native double encoding prevention in htmlspecialchars()

[WordPress Trac]

#17780: Use PHP native double encoding prevention in htmlspecialchars()
-------------------------+--------------------------
 Reporter:  nbachiyski   |       Owner:  miqrogroove
     Type:  enhancement  |      Status:  accepted
 Priority:  normal       |   Milestone:  4.3
Component:  Formatting   |     Version:  3.2.1
 Severity:  normal       |  Resolution:
 Keywords:  has-patch    |     Focuses:
-------------------------+--------------------------

Comment (by miqrogroove):

 After patching, there are three differences in test results:

 * Number of digits is not normalized in numeric references.
 * `'` fails the double-encoding test in PHP for some reason.
 * Entities that were double-encoded at input will ''not'' get decoded for
 output.

 IMO, these all remain acceptable differences.  The original call to
 specialchars_decode appears to be a mistake in [10297] and I am looking
 for any additional information about why that was committed in the first
 place.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/17780#comment:9>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform