{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/10399","repository_url":"https://api.github.com/repos/joomla/joomla-cms","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/10399/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/10399/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/10399/events","html_url":"https://github.com/joomla/joomla-cms/issues/10399","id":154215979,"number":10399,"title":"Always use htmlspecialchars($str, ENT_COMPAT, 'UTF-8')","user":{"login":"mahagr","id":854915,"avatar_url":"https://avatars.githubusercontent.com/u/854915?v=3","gravatar_id":"","url":"https://api.github.com/users/mahagr","html_url":"https://github.com/mahagr","followers_url":"https://api.github.com/users/mahagr/followers","following_url":"https://api.github.com/users/mahagr/following{/other_user}","gists_url":"https://api.github.com/users/mahagr/gists{/gist_id}","starred_url":"https://api.github.com/users/mahagr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mahagr/subscriptions","organizations_url":"https://api.github.com/users/mahagr/orgs","repos_url":"https://api.github.com/users/mahagr/repos","events_url":"https://api.github.com/users/mahagr/events{/privacy}","received_events_url":"https://api.github.com/users/mahagr/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-05-11T11:01:02Z","updated_at":"2016-05-11T11:52:46Z","closed_at":null,"body":"One of our users ran into some issues with his Joomla installation because of his server had `default_charset=latin1` in php.ini.\r\n\r\n    Warning: htmlspecialchars(): charset `latin1' not supported, assuming utf-8 in ....\r\n\r\nDocumentation for `htmlspecialchars()` says that: \"PHP 5.6: The default value for the encoding parameter was changed to be the value of the default_charset configuration option\"\r\n\r\nThe issue can be fixed by making sure that all `htmlspecialchars()` calls have encoding set. \r\n\r\nAdditionally in my tests there is an issue if for some reason incoming encoding is wrong, which is easy to fix by using `ENT_SUBSTITUTE` (PHP 5.4+ only!):\r\n\r\n```php\r\n    var_dump(htmlspecialchars('Täällä olen minä',  ENT_COMPAT, 'UTF-8'));\r\n    var_dump(htmlspecialchars('T'.chr(132).chr(132).'ll'.chr(132).' olen min'.chr(132), ENT_COMPAT, 'UTF-8'));\r\n    var_dump(htmlspecialchars('T'.chr(132).chr(132).'ll'.chr(132).' olen min'.chr(132), ENT_COMPAT|ENT_SUBSTITUTE, 'UTF-8'));\r\n```\r\n\r\nResults: \r\n\r\n    string(20) \"Täällä olen minä\"\r\n    string(0) \"\"\r\n    string(24) \"T��ll� olen min�\"\r\n"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/218437180","html_url":"https://github.com/joomla/joomla-cms/issues/10399#issuecomment-218437180","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/10399","id":218437180,"user":{"login":"Bakual","id":1018684,"avatar_url":"https://avatars.githubusercontent.com/u/1018684?v=3","gravatar_id":"","url":"https://api.github.com/users/Bakual","html_url":"https://github.com/Bakual","followers_url":"https://api.github.com/users/Bakual/followers","following_url":"https://api.github.com/users/Bakual/following{/other_user}","gists_url":"https://api.github.com/users/Bakual/gists{/gist_id}","starred_url":"https://api.github.com/users/Bakual/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Bakual/subscriptions","organizations_url":"https://api.github.com/users/Bakual/orgs","repos_url":"https://api.github.com/users/Bakual/repos","events_url":"https://api.github.com/users/Bakual/events{/privacy}","received_events_url":"https://api.github.com/users/Bakual/received_events","type":"User","site_admin":false},"created_at":"2016-05-11T11:52:45Z","updated_at":"2016-05-11T11:52:45Z","body":"So `latin1` isn't a supported value for `default_charset` and thus it produced the warning. At least I understand the documentation like this.\r\n\r\nI'm a bit with Brian here. While it would be recommended to always specify the encoding in `htmlspecialchars()`, we didn't really experience any issues in the places where it wasn't done.\r\nTechnically, the issue is valid. In practice, it doesn't seem to matter.\r\n\r\nIf someone wants to track down all occurances and fix them, go ahead. It could be a pain to test though."}}