Brett Zamir
Feb 13th

  See my comment under htmlspecialchars()

hacksmw
Feb 11th

  htmlspecialchars_decode function in PHP doesn't work recursive.
but this function is too recursive.
so "☻" will not be converted by this function as "☻"
however, it will be converted as "☻"
on the other hand,
the function in php will convert it as "☻"

Brett Zamir
25 Nov '09

  @Mailfaker: Thanks. I've completely redone the two htmlspecialchars functions in Git, also to handle flags and arguments: http://github.com/kvz/phpjs/commit/881de8748cf986d025ecfad5f448fbbb8ba7710e . Btw, using replace was much faster for me (and easier) than using split and join.

Mailfaker
25 Nov '09

   Hi everyone,
this code wasn't working for me. I have done some changes and now it runs.
The problem is that, for decoding, hash_map table must be read in descending order. Or simply, you can do so:

1
2
3
4
56
7
8

function htmlspecialchars_decode (string) {
    tmp_str = string.toString();
    tmp_str = tmp_str.split('"').join('"');
    tmp_str = tmp_str.split('&lt;').join('<');
    tmp_str = tmp_str.split('&gt;').join('>');    tmp_str = tmp_str.split('&amp;').join('&');
    return tmp_str;
}

Kevin van Zonneveld
16 Aug '09

  @ Liviu Mirea: I added your example as a testcase, but I was unable to reproduce the problem.

What version & browser are you using?

Liviu Mirea
10 Aug '09

  I'm sorry but the messaging system seems to be messed up and I can't post my message. What I'm trying to say is that the above function is incorrect. If you try to decode "& amp; quot;" (remove spaces) it will output a double quotation mark instead of "& quot;" (remove spaces). Hope this message will be properly posted. :/

Liviu Mirea
10 Aug '09

   Erm, ignore my message below, the caracters are messed up.
Here:

1

htmlspecialchars_decode(' " ');

1

"

1

"&"

1

"&"

1

"""

Liviu Mirea
10 Aug '09

1

htmlspecialchars_decode(' " ');

Kevin van Zonneveld
29 Sep '08

  @ ReverseSyntax & Onno Marsman: Wow that was ugly. Sorry everyone. Fixed.

Onno Marsman
25 Sep '08

   There is a serious parse error in this function

1

string = string.replace(/>/g '>');

1

string = string.replace(/>/g, '>');

ReverseSyntax
25 Sep '08

  There is an error in the htmlspecialchars_decode(),
There a single quote around the regex for all params values in replace() except for > the only one that works. this is in the php.min.js

Kevin van Zonneveld
21 Sep '08

   [CODE="php"]
<?php
echo html_entity_decode("&#56;")."\n";
?>
[/CODE]
returns 8.

This behavior is not documented in the PHP manual though, do you know what table is used here?

Trevor
17 Sep '08

  Issue: Doesn't decode all html escaped characters, such as &#56;

Kevin van Zonneveld
27 Jul '08

  @ Bob Palin: Thank you for noticing. It is possible to declare global constants in javascript, but that would increase the number of dependencies throughout this project.

We have deliberately chosen to implement this a bit different from the original PHP documentation to allow for more functions to be included separately.

Bob Palin
27 Jul '08

  The function description says that 'quote_style' is an int and list constants, in fact the argument is a string as shown in the code and example.

Mateusz "loonquawl" Zalega (http://loonquawl.yoyo.
31 May '08

   No problem :)

There's another bug in this function. First argument of called function string.replace() is a string object '/&amp;/g'. It won't work, unless it's a regular expression object (should be /&amp;/g - without the apostrophes).
Here's the correct code:

1
2
3
4
56
7
8
9
1011
12
13
14
1516
17

string = string.toString();
    
    // Always encode
    string = string.replace(/&/g, '&');
    string = string.replace(/</g, '<');    string = string.replace(/>/g, '>');
    
    // Encode depending on quote_style
    if (quote_style == 'ENT_QUOTES') {
        string = string.replace(/"/g, '"');        string = string.replace(/'/g, '\'');
    } else if (quote_style != 'ENT_NOQUOTES') {
        // All other cases (ENT_COMPAT, default, but not ENT_NOQUOTES)
        string = string.replace(/"/g, '"');
    }    
    return string;

Kevin van Zonneveld
31 May '08

  @ loonquawl: Guess it should ;) thank you!

loonquawl
31 May '08

   Shouldn't it be

1
2
3

string = string.replace(/&/g, '&');
   string = string.replace(/</g, '<');
   string = string.replace(/>/g, '>');