Assuming my project is utf-8 throughout and has always been used with utf-8 encoding, is there anything legit that could possibly break if I change all occurances of htmlspecialchars($var)
to htmlspecialchars($var, ENT_QUOTES, 'utf-8')
?
I do know one thing: Obviously, ENT_QUOTES
differs from ENT_COMPAT
in that it also escapes single quotation marks. Assuming I know that this alone won't break anything, is there anything else left over?
Differently worded:
Is there a conceivable result of htmlspecialchars() when used without the charset parameter, given data only from the charset, that would differ from htmlspecialchars() when used with the charset parameter?
(Is, at any point, htmlspecialchars($stringThatIsValidUTF8, ENT_QUOTES) !== htmlspecialchars($stringThatIsValidUTF8, ENT_QUOTES, 'utf-8')
?)
My understanding says no, never. Another question here on stackoverflow suggests no, too. So far, browsing my sandbox of the project with the changes also says no. However, I'm not sure if I'm overlooking something. I'm in a rather paranoid mood at the moment! :)