Merge pull request #31 from vrana/master

Invalid escaping in renderBaseAttrs
hhvm · Feb 15, 2012 · 17f05e1 · 17f05e1
2 parents 0ff0c6d + 0a99f67
commit 17f05e1
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/php-lib/html.php b/php-lib/html.php
@@ -65,7 +65,7 @@ protected final function renderBaseAttrs() {
     $buf = '<'.$this->tagName;
     foreach ($this->getAttributes() as $key => $val) {
       if ($val !== null && $val !== false) {
-        $buf .= ' ' . htmlspecialchars($key) . '="' . htmlspecialchars($val, true) . '"';
+        $buf .= ' ' . htmlspecialchars($key) . '="' . htmlspecialchars($val) . '"';
       }
     }
     return $buf;

diff --git a/tests/attr-quotes.phpt b/tests/attr-quotes.phpt
@@ -0,0 +1,9 @@
+--TEST--
+Quotes in attribute
+--FILE--
+<?php
+class xhp_a {}
+$quote = '"';
+echo <a b={$quote}>c</a>;
+--EXPECT--
+<a b="&quot;">c</a>