php output xml produces parse error "’"

Question

Hi,

Is there any function that I can use to parse any string to ensure it won't cause xml parsing problems? I have a php script outputting a xml file with content obtained from forms.

The thing is, apart from the usual string checks from a php form, some of the user text causes xml parsing errors. I'm facing this "’" in particular. This is the error I'm getting Entity 'rsquo' not defined

Does anyone have any experience in encoding text for xml output?

Thank you!

---

Some clarification: I'm outputting content from forms in a xml file, which is subsequently parsed by javascript.

I process all form inputs with: htmlentities(trim($_POST['content']), ENT_QUOTES, 'UTF-8');

When I want to output this content into a xml file, how should I encode it such that it won't throw up xml parsing errors?

So far the following 2 solutions work:

1) echo '<content><![CDATA['.$content.']]></content>';

2) echo '<content>'.htmlspecialchars(html_entity_decode($content, ENT_QUOTES, 'UTF-8'),ENT_QUOTES, 'UTF-8').'</content>'."\n";

Are the above 2 solutions safe? Which is better?

Thanks, sorry for not providing this information earlier.

Answer 1

html_entity_decode($string, , ENT_QUOTES, 'UTF-8')

Answer 2

You take it the wrong way - don't look for a parser which doesn't give you errors. Instead try to have a well-formed xml.

How did you get ’ from the user? If he literally typed it in, you are not processing the input correctly - for example you should escape & to &. If it is you who put the entity there (perhaps in place of some apostrophe), either define it in DTD (<!ENTITY rsquo "&x2019;">) or write it using a numeric notation (’), because almost every of the named entities are a part of HTML. XML defines only a few basic ones, as Gumbo pointed out.

EDIT based on additions to the question:

• In #1, you escape the content in the way that if user types in ]]> <°)))><, you have a problem.
• In #2, you are doing the encoding and decoding which result in the original value of the $content. the decoding should not be necessary (if you don't expect users to post values like & which should be interpreted like &).

If you use htmlspecialchars() with ENT_QUOTES, it should be ok, but see how Drupal does it.

Answer 3

Enclose the value within CDATA tags.

<message><![CDATA[&rsquo;]]></message>

From the w3schools site:

Characters like "<" and "&" are illegal in XML elements.

"<" will generate an error because the parser interprets it as the start of a new element.

"&" will generate an error because the parser interprets it as the start of an character entity.

Some text, like JavaScript code, contains a lot of "<" or "&" characters. To avoid errors script code can be defined as CDATA.

Everything inside a CDATA section is ignored by the parser.

Answer 4

The problem is that your htmlentities function is doing what it should - generating HTML entities from characters. You're then inserting these into an XML document which doesn't have the HTML entities defined (things like ’ are HTML-specific).

The easiest way to handle this is keep all input raw (i.e. don't parse with htmlentities), then generate your XML using PHP's XML functions.

This will ensure that all text is properly encoded, and your XML is well-formed.

Example:

$user_input = "...<>&'";

$doc = new DOMDocument('1.0','utf-8');

$element = $doc->createElement("content");
$element->appendChild($doc->createTextNode($user_input));

$doc->appendChild($element);