Question

How can I escape a string containing random characters with php for a plist file? htmlentities() seems doesn’t seem to be strict enough. For example:

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <string><?php echo htmlentities("@!£$%^&*)}{:|<>/");?></string>
</plist>

doesn’t work.

Answer 1

CDATA should be the correct way:

 <plist version="1.0">
  <string><![CDATA[<?php echo "@!£$%^&*)}{:|<>/"; ?>]]></string>
 </plist>

The only thing in the content you would have to escape is the actual <![CDATA[ opener itself.

If that doesn’t work for some reasons, rawurlencode() turns all non-alphanumeric characters into RFC 1738 codes, which your target may be able to digest more easily.