Question

I wrote a class to parse bbcode but I have a problem when I use the “escape” (function chtml::encode is a wrapper for htmlspecialchars).

MyBBcodeParser: http://snipt.org/srlo0

Case “BBcodeParser::toHtml($input, false)”:
Input: [b]hello[/b] <strong>hello2</strong>
Output: <strong>hello</strong> <strong>hello2</strong> (bold applied)

Case “BBcodeParser::toHtml($input, true)”:
Input: [b]hello[/b] <strong>hello2</strong>
Output: &lt;strong&gt;hello&lt;/strong&gt;&amp;lt;strong&amp;gt;hello2&amp;lt;/strong&amp;gt;

I can not understand the double-escape from the second case…

Answer 1

Well if you call BBcodeParser::toHtml($input, true) with your input then the following is returned:

<strong>hello</strong> &lt;strong&gt;hello2&lt;/strong&gt;

This is because the CHtml::encode is applied before the preg_replace, thus leaving the HTML-code which was generated after the from the BBcode intact, while escaping the HTML code from the input (the seconds <strong>, that one around the hello2).

Now if you apply CHtml::encode again to the result of the “escaped” BBcode it becomes like you posted (notice the < in the first strong and the < in the second):

<strong>hello</strong><strong>hello2</strong>

In the first case there seems to be no encoding at all.