functions_general.php: htmlspecialchars missing parameters?

[lat9]

Zen Cart v1.5.4: /includes/functions/functions_general.php (function zen_db_output, line 970):

////
  function zen_db_output($string) {
    return htmlspecialchars($string);
  }

Is there a reason why this isn't coded as:

////
  function zen_db_output($string) {
    return htmlspecialchars($string, ENT_COMPAT, CHARSET, TRUE);
  }

[DrByte]

I think that's an oversight in legacy code.

And I'm pretty sure that all remaining references to zen_db_output() should actually be using zen_output_string_protected() instead.

Further, I think a review of all direct calls to htmlspecialchars() should be done to replace them with zen_output_string_protected() also ... unless there's a specific reason not to.

More for the to-do list! https://github.com/zencart/zencart/issues/270