Home » Structures » Structures_DataGrid » Bug #6151

[2005-12-05 10:41 UTC] sebastien_mouren at hotmail dot com

Description:
------------
In: HTMLTable.php,v 1.64
Inside _buildHTMLTableHeader() in the HTMLTable renderer, $url isn' encoded properly according to the spec.
http_build_query() construct the query but doesn't URL-encode anything.

Test script:
---------------
Proposed lazy change:

Add in line 432:
$url = htmlentities($url, ENT_QUOTES);

Problem this could break compatibility with earlier PhP and would be better if Unicode encoded.

Expected result:
----------------
Correctly encoded URL:
/table.php?orderBy=release&direction=ASC&page=1

Actual result:
--------------
Incorrecly encoded URL:
/table.php?orderBy=release&direction=ASC&page=1

[2006-03-01 22:40 UTC] olivierg at php dot net

Sorry, but this is no Structures_DataGrid bug or missing feature.

In order to customize the GET arguments separator used by http_build_query() you should use the "arg_separator.output" php ini setting, as stated in the PHP manual :

http://www.php.net/manual/en/function.http-build-query.php

[2006-03-03 19:28 UTC] olivierg at php dot net

Okay, sorry.. After discussing about this issue on pear-dev, I've implemented this htmlentities() workaround.

It's in CVS.

However I'm not sure what to do with your sentence : "Problem this could break compatibility with earlier PhP and would be better if Unicode encoded."

[2006-03-03 20:05 UTC] olivierg at php dot net

There's already a new "encoding" option in the HTMLTable driver. That can be passed as the 3rd argument to htmlentities()...

But :
1 - shouldn't we use htmlspecialchars() instead ?
2 - what about "this could break compatibility with earlier PhP" ?

Mark ? Andrew ?

[2006-03-07 13:03 UTC] olivierg at php dot net

Okay, this bug is fixed in CVS. htmlentities() is called over http_build_query() and the new renderer 'encoding' option is taken into account.

Are you sure that it won't break for PHP < 4.1 ? The http_build_query() manpage states that the third (charset) parameter support was added in PHP 4.1... Sorry I can't test that in here.

I've added a dependency on PHP >= 4.1 in package.xml. Tell me what you think about this.

Links added by formatters are the sole responsibility of the user IMO. Because the formaters have to return something like "<a href="mylink">MyLink</a>", we certainly can't run htmlentities()

The point is : when a user makes a formatter, he/she knows what driver he/she is using, and what kind of precise output he/she wants... I think that changing what formatters return could even be considered intrusive by certain users.