| Package home | Report new bug | New search | Development Roadmap | Status: Open | Feedback | All | Closed Since Version 0.9.3 |
| Request #6151 | Need to encode URL correctly in HTMLTable renderer | ||
|---|---|---|---|
| Submitted: | 2005-12-05 10:41 UTC | ||
| From: | sebastien_mouren at hotmail dot com | Assigned: | olivierg |
| Status: | Closed | Package: | Structures_DataGrid |
| PHP Version: | 4.3.10 | OS: | Linux 2.4.29-11 |
| Roadmaps: | (Not assigned) | ||
[2005-12-05 10:41 UTC] sebastien_mouren at hotmail dot com
Description:
------------
In: HTMLTable.php,v 1.64
Inside _buildHTMLTableHeader() in the HTMLTable renderer, $url isn' encoded properly according to the spec.
http_build_query() construct the query but doesn't URL-encode anything.
Test script:
---------------
Proposed lazy change:
Add in line 432:
$url = htmlentities($url, ENT_QUOTES);
Problem this could break compatibility with earlier PhP and would be better if Unicode encoded.
Expected result:
----------------
Correctly encoded URL:
/table.php?orderBy=release&direction=ASC&page=1
Actual result:
--------------
Incorrecly encoded URL:
/table.php?orderBy=release&direction=ASC&page=1
Comments
[2006-03-01 22:40 UTC] olivierg at php dot net
Sorry, but this is no Structures_DataGrid bug or missing feature.
In order to customize the GET arguments separator used by http_build_query() you should use the "arg_separator.output" php ini setting, as stated in the PHP manual :
http://www.php.net/manual/en/function.http-build-query.php
[2006-03-03 19:28 UTC] olivierg at php dot net
Okay, sorry.. After discussing about this issue on pear-dev, I've implemented this htmlentities() workaround.
It's in CVS.
However I'm not sure what to do with your sentence : "Problem this could break compatibility with earlier PhP and would be better if Unicode encoded."
[2006-03-03 20:05 UTC] olivierg at php dot net
There's already a new "encoding" option in the HTMLTable driver. That can be passed as the 3rd argument to htmlentities()...
But :
1 - shouldn't we use htmlspecialchars() instead ?
2 - what about "this could break compatibility with earlier PhP" ?
Mark ? Andrew ?
[2006-03-03 22:15 UTC] User who submitted this comment has not confirmed identity
If you submitted this note, check your email.If you do not have a message, click here to re-send MANUAL CONFIRMATION IS NOT POSSIBLE. Write a message to pear-dev@lists.php.net to request the confirmation link. All bugs/comments/patches associated with this email address will be deleted within 48 hours if the account request is not confirmed!
[2006-03-06 12:48 UTC] User who submitted this comment has not confirmed identity
If you submitted this note, check your email.If you do not have a message, click here to re-send MANUAL CONFIRMATION IS NOT POSSIBLE. Write a message to pear-dev@lists.php.net to request the confirmation link. All bugs/comments/patches associated with this email address will be deleted within 48 hours if the account request is not confirmed!
[2006-03-07 13:03 UTC] olivierg at php dot net
Okay, this bug is fixed in CVS. htmlentities() is called over http_build_query() and the new renderer 'encoding' option is taken into account.
Are you sure that it won't break for PHP < 4.1 ? The http_build_query() manpage states that the third (charset) parameter support was added in PHP 4.1... Sorry I can't test that in here.
I've added a dependency on PHP >= 4.1 in package.xml. Tell me what you think about this.
Links added by formatters are the sole responsibility of the user IMO. Because the formaters have to return something like "<a href="mylink">MyLink</a>", we certainly can't run htmlentities()
The point is : when a user makes a formatter, he/she knows what driver he/she is using, and what kind of precise output he/she wants... I think that changing what formatters return could even be considered intrusive by certain users.
[2006-03-08 20:29 UTC] User who submitted this comment has not confirmed identity
If you submitted this note, check your email.If you do not have a message, click here to re-send MANUAL CONFIRMATION IS NOT POSSIBLE. Write a message to pear-dev@lists.php.net to request the confirmation link. All bugs/comments/patches associated with this email address will be deleted within 48 hours if the account request is not confirmed!