Home Blog Tech Stuff Escaping XML Reserved Characters in PHP

Escaping XML Reserved Characters in PHP

Sunday, 15 February 2009 15:06
E-mail Print PDF

I just stumbled across this function in some of my old PHP code and since I replied to an issue on the Joomla! forums only the other day about this same thing, I thought I'd post it here seeing that I have a couple of notes about XHTML already on this site:

function xmlspecialchars($text) {
   return str_replace(''', ''', htmlspecialchars($text, ENT_QUOTES));
}

I don't remember if I read through the XML specs and wrote this myself or whether I just found it somewhere, but I have a feeling I checked it all out at the time and I think this covers all the necessary escaping for XHTML...please somebody let me know if I'm mistaken!

Last Updated on Thursday, 10 September 2009 02:16  

Comments

RE: Escaping XML Reserved Characters in PHP from http://matthiasvdh.myopenid.com/ on Wed. Mar 24, 2010  reply 

The function htmlspecialchars() is useful to convert any string into something that won't upset the browser if put in X(HT)ML tags. Also, you can safely use the output as a value for an attribute (converting the single and double quotes makes sure it will output valid HTML).

However, it might run into issues if you use the value as a form action, as you do on the Joomla! forum. The attribute 'action' expects a URI, so you might need to urlencode some parts of the string to make it valid.

As for the str_replace in your code: it replaces the decimal code for a single quote, to the HTML entity '. Unofrtunately, the latter is not supported by Internet Explorer. Drop the replacement and the code will work fine.