Feznizzle:
True. Because on that site, the database contains &'s. On the live site, you will also see &'s but those are actually html (which validates).
That's what I did on the live site. But I have several problems with that. First, I'm lazy! That's a lot of extra work when dealing with thousands of products and hundreds of categories. And it's dangerous, counting on all users to remember to clean special characters when building content. On the flip site, what happens when the data is needed elsewhere? It has to be cleaned in the opposite direction, replacing html specials with text versions.
Then there is the possible complications that MC12345678 points out!
That's very scary to me. I'm going to be looking at it, but its very scary!
++++++++++++++++++++++++++
I don't know if that code above is really what I want. I noticed this little routine (/includes/functions/functions_general.php)
////
//CLR 030228 Add function zen_decode_specialchars
// Decode string encoded with htmlspecialchars()
function zen_decode_specialchars($string){
$string=str_replace('>', '>', $string);
$string=str_replace('<', '<', $string);
$string=str_replace(''', "'", $string);
$string=str_replace('"', """, $string);
$string=str_replace('&', '&', $string);
[B]$string=str_replace('°', '°', $string);[/B]
return $string;
}
////
>
> I'm not sure what's going on there, but I like the idea that I can add specific characters, based upon needs. I added that last one as an example.
> ++++++++++++++++++++++++++
>
>
> Guys, I did find this bit of code (from here: <http://php.net/manual/en/function.htmlspecialchars.php>)
> ```
string htmlspecialchars ( string $string [, int $flags = ENT_COMPAT | ENT_HTML401 [, string $encoding = ini_get("default_charset") [, bool $double_encode = true ]]] )
I wish I could program! I think I need something like that to clean the output anywhere that an alt tag or href tag gets displayed (sent to a browser). As MC12345678 points out, there are lots of places where such output gets created.
But what if that scrubber got placed at a top level, like the main header? One place, not a zillion.
What if there was an observer that just waited for href's and alt's? If it saw one, it scrubbed it before display?
Anyway, can this be done? Can a little snippet be inserted somewhere that listens for alt/href and then cleans before output?
How hard would that be?
That type of operation (htmlspecialchars) is provided with a few of the functions in the includes/functions/functions_general.php file:
function zen_output_string($string, $translate = false, $protected = false) {
Or more specifically/easily:
function zen_output_string_protected($string) {
As to the listening for everything aspect... That's a different subject/topic than the above two functions. Would have to prevent any content from being pushed to the display before being processed by the listener. Otherwise the HTML5 aspect just basically is that HTML5 is more "intelligent" about the validation of characters such as & (ampersand), allowing coders/authors to be just as indicated more lazy. :)
Generally the little "snippet" is what is added to the code where it might be expected that html will be included in the content to be displayed. The use of the & in strings such as categories, attributes, and even product (if I remember correctly) has not been a specific character to be addressed in past versions. I haven't looked at ZC 1.5.5 to see how it behaves with that additional character, but when I have helped others to validate their site, I have on occasion made the suggestion that they use & in their original data.
Lot's of ways to go about it though. :)
