Bug #61354 [Com]: htmlentities and htmlspecialchars doesn't respect the default_charset

2013-02-26 Thread rudibr at gmail dot com
Edit report at https://bugs.php.net/bug.php?id=61354&edit=1

 ID: 61354
 Comment by: rudibr at gmail dot com
 Reported by:hufeng1987 at gmail dot com
 Summary:htmlentities and htmlspecialchars doesn't respect
 the default_charset
 Status: Not a bug
 Type:   Bug
 Package:Strings related
 Operating System:   Linux/Windows/
 PHP Version:5.4.0
 Block user comment: N
 Private report: N

 New Comment:

What about my third-party modules? Should I change their code as well? Do I now 
need to verify and manually alter code on third-party modules everytime I 
upgrade or install them?

If Im using a component with protected code, do I need to go trough their 
support staff and wait for a correction? What if they provide no reliable 
support or customization, am I now being encouraged to hack and crack in the 
source code just so I can fix this?

It is easy , even redundant , and absolutely justfiable to create a new ini 
setting to control this behavior, that I feel a little bit offended by the 
current attitude of php developers over this issue.

I also feel a little bit offended because the guy who is responsible for this 
change EXPLICITLY stated that the change to UTF-8 defaulting have nothing to do 
with security. It just sounded like a "better default", according to the 
developer. Hardly a seriously thought-trough consideration.

This is becoming quite a sad state of affairs. I guess I will have to consider 
moving on from php if it comes to that.


Previous Comments:

[2013-01-27 17:32:18] kstirn at gmail dot com

It will soon be a year since the release of PHP 5.4 and there still is no easy 
way (read: a global PHP setting) to overcome this huge 
backwards-incompatibility. 

PHP developers, I understand the security concerns, but please don't be so 
stubborn and give us an option to set a default setting without having to 
modify *all* legacy code to work with 5.4.

Your action (or lack thereof) is producing the opposite results of desired - 
instead of moving to PHP 5.4, thousands of servers (including several we own) 
will stay with 5.3.x even after end of life cycle in March 2013.

*Fact*
A simple global setting (an optional php.ini value) would solve the issue for 
thousands of users while addressing security issues by explicitly defining the 
default charset to be used by affected functions - all without having to 
rewrite existing code.

PHP team please do reconsider this and help everyone not using UTF-8 move to 
PHP 5.4.

Thank you!


[2013-01-05 17:39:04] x dot bazilio at gmail dot com

Ok. If i did not set defautlt time zone, i get E_WARNING.
Let us set default encoding for htmlspecialchars. It is not posible to persuade 
developers of Drupal, joomla, wordpress, bitrix, ets., and developers of 
modules 
for that CMS to rewrite their code.
I wrote to tech support of bitrix (russian cms). They said that i must use PHP 
5.3.x. They not going to rewrite code.


[2013-01-05 16:05:31] leaflet at leafok dot com

I understand your consideration. Maybe a global configuration in PHP.ini or 
page 
lifecycle set function could be provided for encoding setting of these 
functions. 
Developers would be glad to handle this setting centrally by a include header 
file 
for each pages.


[2013-01-05 15:17:56] ras...@php.net

I have explained that a few times. We can't default it automatically because 
the  
encoding may not match the output encoding. Only the developer knows that. If 
we 
did that automatically it would break even more sites. The sites where the 
encodings differ need to set it explicitly.


[2013-01-05 09:54:44] hufeng1987 at gmail dot com

pass null and empty string that could improve security? no sense..




The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

https://bugs.php.net/bug.php?id=61354


-- 
Edit this bug report at https://bugs.php.net/bug.php?id=61354&edit=1


Bug #61354 [Com]: htmlentities and htmlspecialchars doesn't respect the default_charset

2012-12-28 Thread rudibr at gmail dot com
Edit report at https://bugs.php.net/bug.php?id=61354&edit=1

 ID: 61354
 Comment by: rudibr at gmail dot com
 Reported by:hufeng1987 at gmail dot com
 Summary:htmlentities and htmlspecialchars doesn't respect
 the default_charset
 Status: Not a bug
 Type:   Bug
 Package:Strings related
 Operating System:   Linux/Windows/
 PHP Version:5.4.0
 Block user comment: N
 Private report: N

 New Comment:

This is a serious backward incompatibility (and not even listed as such).

I am also not able to upgrade to 5.4 because of this, and have advised all of 
my 
clients which I provide server consulting to do not upgrade as well.

No defaults of any kind should be changed arbitrarily , without notice and 
without 
possibility of customization. It breaks code, and makes everyone affected very 
uneasy on any future relases.

Like all here I hope this get the serious attention it should have gotten 
already.


Previous Comments:

[2012-11-28 09:28:16] x dot bazilio at gmail dot com

This is a bug.
Just upgraded php and got empty string on many projects.
I cant't change code in CMS, because i am not a developer of CMS. I am using 
CMS 
fore develop web sites.


[2012-08-27 17:04:46] goodwaiter at gmail dot com

because use htmlspecialchars($text,NULL,""); can make works fine;

so php Developer can fix this bug in this easy way:
just make "omitted encoding" works like encoding with "", and all things will 
be 
ok.


[2012-08-27 16:37:32] goodwaiter at gmail dot com

another fix way in code is that:
use htmlspecialchars($text,NULL,"")
not need to add "utf8" "cp936",  or other in "", just leave "" blank, it will 
use 
the current page's encoding like no this bug.


[2012-08-27 16:24:39] goodwaiter at gmail dot com

the post above is wrong,change from "Non Thread Safe" to "Thread Safe" cant fix 
it.

right fix way:
so guys above can change to windows + iis + isapi module + php, or windows + 
Apache + fastcgi/isapi module + php, can fix this bug.

I just test, only windows + iis + fastcgi + php will show the bug.
in isapi module or windows + Apache + fastcgi + php works fine.

and I test that,the bug maybe because of iis fastcgi.
in this case, Zend Multibyte Support allways be "provided by mbstring", even if 
I change zend.multibyte to off or on, it still "provided by mbstring".
in phpinfo() show below:

mbstring
Multibyte Support  enabled  
Multibyte string engine  libmbfl  
HTTP input encoding translation  disabled  
libmbfl version  1.3.2  

mbstring extension makes use of "streamable kanji code filter and converter", 
which is distributed under the GNU Lesser General Public License version 2.1. 

Multibyte (japanese) regex support  enabled  
Multibyte regex (oniguruma) version  4.7.1  

and I use this code to test on windows + iis6 + fastcgi + php:

echo(mb_internal_encoding());// show ISO-8859-1, right
$text = "我是测试";//use cp936 chinese chars
$ary[] = "ASCII";
$ary[] = "JIS";
$ary[] = "CP936";
$ary[] = "UTF-8";
echo mb_detect_encoding($text, $ary);//show cp936, right
mb_detect_order($ary);//set detect order
echo(htmlspecialchars($text));//show enmty, wrong !!!
echo mb_detect_encoding(htmlspecialchars($text), $ary);//show ASCII(not the guy 
think is utf8), wrong 
echo(mb_internal_encoding());// show ISO-8859-1, not change, right

this test can show us that, all things goes right except htmlspecialchars(), 
where is the "ASCII" from? maybe iis6 + fastcgi cause this bug. but it's really 
a php bug.


[2012-08-27 13:17:48] goodwaiter at gmail dot com

虽然更换到非线程安å…
¨ç‰ˆæœ¬èƒ½è§£å†³é—®é¢˜ï¼Œä½†æ˜¯éš¾ä¿ä¸‹æ¬¡ç‰ˆæœ¬ï¼ŒPHP不会把非线程安å…
¨ç‰ˆæœ¬çš„æ­£å¸¸è¡¨çŽ°å½“ä½œ
BUG更新掉,所以我们要让PHP知道这确实是一个BUG。
BUG的中文表述很简单:
php.ini的Default encoding或者
mb-internal-encoding的设置,对htmlspecialchars, 
htmlentities无
效,这两个函数顽强的使用自己的utf-8,自以为是。
更流行的表述是:
htmlspecialchars, htmlentities独立使用自己的编ç 
ï¼Œè¿™è¿åç»Ÿä¸€å¤§å±€ï¼ŒPHP肯定不能容忍这样的存
在,必须要铲除这个BUG




The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

https://bugs.php.net/bug.php?id=61354


-- 
Edit this bug report at https://bugs.php.net/bug.php?id=61354&edit=1