Decode htmlentities in emails and logs

[Technical-13]

It's real annoying (and I'm sure confusing to new users) to see escaped entities in emails and in the logs on the requests... I understand escaping for the purpose of the database, but these things should be decoded before being displayed and sent in emails. I'm assuming that we are throwing them in the db with http://us2.php.net/manual/en/function.htmlentities.php and as such, when we pull them back out we should be using http://us2.php.net/html_entity_decode

[stwalkerster]

Actually, I am a) sorting this as part of the PDO cleanup, and b) that is
incorrect.

We should not be using either of those functions in ~95% of the places they
are used at the moment. The escaping we SHOULD be doing is limited to
a) pre-database quote escaping using mysql_real_escape_string() (for
legacy code only)
b) pre-html-display escaping using the |escape modifier or
htmlentites() (latter for legacy only).

Escaping has been a perennial problem for us, we've gone from escaping
everything in different amounts everywhere, leading to issues like the one
you're probably seeing (and data corruption), to no escaping in places
leading to XSS holes or SQL injection points.

As part of the PDO cleanup, I'm writing scripts to clean up and fix the
database, but I've only done the ban table properly so far.
On 7 Mar 2014 12:46, "Donald J. Fortier II" notifications@github.com
wrote:

It's real annoying (and I'm sure confusing to new users) to see escaped
entities in emails and in the logs on the requests... I understand escaping
for the purpose of the database, but these things should be decoded before
being displayed and sent in emails. I'm assuming that we are throwing them
in the db with http://us2.php.net/manual/en/function.htmlentities.php and
as such, when we pull them back out we should be using
http://us2.php.net/html_entity_decode

Reply to this email directly or view it on GitHubhttps://github.com//issues/144
.

[FunPika]

Where exactly are you seeing this? This is probably someone double escaping or forgetting an html_entity_decode somewhere in legacy code.

[Technical-13]

[stwalkerster]

Fixed in newinternal