Adding a value that contains "&" in a template breaks it about phpword HOT 6 CLOSED

htmlspecialchars change (&, ', ", <, >) by theirs HTML equivalents.

After having inserted some texts in a DOCX file, i confirm the need of use of htmlspecialchars :

<w:p>
  <w:pPr>
    <w:pStyle w:val="style0"/>
    <w:rPr><w:rFonts w:cs="Mangal" w:eastAsia="SimSun"/></w:rPr>
  </w:pPr>
  <w:r>
    <w:rPr></w:rPr>
    <w:t>Texte&amp;Texte</w:t>
  </w:r>
  <w:r>
    <w:rPr></w:rPr>
    <w:t>&apos;Texte</w:t>
  </w:r>
  <w:r>
    <w:rPr></w:rPr>
    <w:t>&quot;</w:t>
  </w:r>
  <w:r>
    <w:rPr></w:rPr>
    <w:t>Texte&lt;Texte&gt;Texte</w:t>
  </w:r>
</w:p>

from phpword.

Fixed in develop branch

from phpword.

I've tested this with last dev-master (38d3d7b), it works like a charm

Thanks!

from phpword.

Guys, I wouldn't agree with you.

First, as for me, I escape data before exporting it in any format (HTML, OOXML, no matter). Second time escaping brokes my data.

Second, there are already tons of libraries which offer escaping functionality (e.g. Zend/Escaper). And they are pretty good. Data escaping is much more than single htmlspecialchars call which we have here.

As regards escaping strategy. Output should be escaped and everybody knows this. Escaping should be performed after all data transformations. It's a well-known rule too. PhpWord is a library which helps to build OOXML (and other) documents, based on the provided data. It doesn't change the data, it just packs the data into another format. There are also libraries which help to build HTML pages. So, if we escape data before submitting to HTML builders, why not to escape data before submitting to PhpWord? I don't see any difference here. And my applications goes this way. I can support tons of different formats and escape only once and in one place. Morever, there is no need to implement the same escaping functionality in all libraries for all formats of documents. Just escape data out of the library. Remember: escape once, use multiple times. :)

So, I'm gonna to remove the htmlentities call. Any objections?

from phpword.

New escaping functionality will be considered in scope of #483.

from phpword.

thanks, i was strangled with < as well, thanks

from phpword.