Since PHP 5.2.3, the htmlspecialchars() function has an optional $double_encode parameter, which we can now use. This will save us a few expensive kses/html decoding calls.

Adds unit tests.

Props miqrogroove.
Fixes #17780.


git-svn-id: https://develop.svn.wordpress.org/trunk@32850 602fd350-edb4-49c9-b593-d223f7449a82

tests/phpunit/tests/formatting/EscAttr.php

@@ -26,7 +26,7 @@ class Tests_Formatting_EscAttr extends WP_UnitTestCase {
 	}
 
 	function test_esc_attr_amp() {
-		$out = esc_attr( 'foo & bar &baz; '' );
-		$this->assertEquals( "foo & bar &baz; '", $out );
+		$out = esc_attr( 'foo & bar &baz;  ' );
+		$this->assertEquals( "foo & bar &baz;  ", $out );
 	}
 }

tests/phpunit/tests/formatting/EscHtml.php

@@ -34,7 +34,7 @@ class Tests_Formatting_EscHtml extends WP_UnitTestCase {
 
 	function test_ignores_existing_entities() {
 		$source = '& £ " &';
-		$res = '& £ " &';
+		$res = '& £ " &';
 		$this->assertEquals( $res, esc_html($source) );
 	}
 }

tests/phpunit/tests/formatting/JSEscape.php

@@ -23,13 +23,13 @@ class Tests_Formatting_JSEscape extends WP_UnitTestCase {
 	}
 
 	function test_js_escape_amp() {
-		$out = esc_js('foo & bar &baz; '');
-		$this->assertEquals("foo & bar &baz; '", $out);
+		$out = esc_js('foo & bar &baz;  ');
+		$this->assertEquals("foo & bar &baz;  ", $out);
 	}
 
 	function test_js_escape_quote_entity() {
 		$out = esc_js('foo ' bar ' baz &');
-		$this->assertEquals("foo \\' bar \\' baz &", $out);
+		$this->assertEquals("foo \\' bar \\' baz &", $out);
 	}
 
 	function test_js_no_carriage_return() {

tests/phpunit/tests/formatting/WPSpecialchars.php

@@ -17,6 +17,10 @@ class Tests_Formatting_WPSpecialchars extends WP_UnitTestCase {
 
 		// Allowed entities should be unchanged
 		foreach ( $allowedentitynames as $ent ) {
+			if ( 'apos' == $ent ) {
+				// But for some reason, PHP doesn't allow '
+				continue;
+			}
 			$ent = '&' . $ent . ';';
 			$this->assertEquals( $ent, _wp_specialchars( $ent ) );
 		}
@@ -39,4 +43,58 @@ class Tests_Formatting_WPSpecialchars extends WP_UnitTestCase {
 		$this->assertEquals( '"'hello!'"', _wp_specialchars($source, true) );
 		$this->assertEquals( $source, _wp_specialchars($source) );
 	}
+
+	/**
+	 * Check some of the double-encoding features for entity references.
+	 *
+	 * @ticket 17780
+	 * @dataProvider data_double_encoding
+	 */
+	function test_double_encoding( $input, $output ) {
+		return $this->assertEquals( $output, _wp_specialchars( $input, ENT_NOQUOTES, false, true ) );
+	}
+
+	function data_double_encoding() {
+		return array(
+			array(
+				'This & that, this & that, — " " Ú   " " " " " $ ×',
+				'This & that, this & that, — " " Ú   " " " " " $ ×',
+			),
+			array(
+				'&& && && &;',
+				'&& && && &;',
+			),
+			array(
+				'&garbage; &***; &aaaa; &0000; &####; &;;',
+				'&garbage; &***; &aaaa; &0000; &####; &;;',
+			),
+		);
+	}
+
+	/**
+	 * Check some of the double-encoding features for entity references.
+	 *
+	 * @ticket 17780
+	 * @dataProvider data_no_double_encoding
+	 */
+	function test_no_double_encoding( $input, $output ) {
+		return $this->assertEquals( $output, _wp_specialchars( $input, ENT_NOQUOTES, false, false ) );
+	}
+
+	function data_no_double_encoding() {
+		return array(
+			array(
+				'This & that, this & that, — " " Ú   " " " " " $ ×',
+				'This & that, this & that, — " " Ú   " " " " " $ ×',
+			),
+			array(
+				'&& && && &;',
+				'&& && && &;',
+			),
+			array(
+				'&garbage; &***; &aaaa; &0000; &####; &;;',
+				'&garbage; &***; &aaaa; &0000; &####; &;;',
+			),
+		);
+	}
 }