Home » HTML » HTML_Crypt » Bug #2990

[2004-12-19 18:19 UTC] sjwalter at visi dot com

Description:
------------
The encrypted string generated in the class will fail an HTML validation test when attempting to validate against the XHTML 1.0 DTDs. Both Strict and Transitional have been tried.

Reproduce code:
---------------
<?php
$crypt = new HTML_Crypt('my_email@home.com', 6);

$crypt->setText('<a href="mailto:my_email@home.com">Email me</a>');

echo $crypt->output();
?>

Save out page, and attempt to validate against a service such as W3C's HTML Validator.

Expected result:
----------------
Successfull validation.

Actual result:
--------------
The validator fails because the encrypted string contains characters that are outside the acceptable range for SGML documents.

This could be remedied by changing the encoding slightly:

1) in cryptText(), replace

$enc_string.=($enc_char == '\\' ? '\\\\' : $enc_char);

with

$enc_string.=(strlen(dechex($inter))<2)?"0".dechex($inter):dechex($inter);

2) in getScript(), replace

$script = "<script language=\"JavaScript\" type=\"text/JavaScript\">var a,s,n;function $rnd(s){r='';for(i=0;i<s.length;i++){n=s.charCodeAt(i);if(n>=8364){n=128;}r+=String.fromCharCode(n-".$this->offset.");}return r;}a='".$this->cryptString."';document.write ($rnd(a));</script>";

with

$script = "<script type=\"text/javascript\">\r//<![CDATA[\rvar a,s,n;function $rnd(s){r='';for(i=0;i<s.length;i+=2){n=parseInt(s.charAt(i) + s.charAt(i+1), 16);if(n>=8364){n=128;}r+=String.fromCharCode(n-".$this->offset.");}return r;}a='".$this->cryptString."';document.write ($rnd(a));\r//]]>\r</script>";

Note, this also removes the 'language' attribute of the <script> element (as that's no longer needed).

This effectively converts the encripted string to 2-character hex, making it palatable to the validator.

[2006-02-27 16:26 UTC] phunkymunky at gmail dot com

The supplied fix didn't work for me. Is this bug going to be attended to???

It is a bit annoying as the only page I use the HTML_Crypt function is on my 'about' page, which also has the link to the XHTML validator :-/