PHP DOMDocument returning quotation marks as special/HTML characters

Question

$string = '<p><a href="http://example.com">Link</a></p>'; // via $_POST['post-content']
$dom = new DOMDocument();
$dom->loadHTML($string);
$allowed_attributes = array('id','href', 'src', 'class', 'style', 'colspan', 'rowspan');
foreach($dom->getElementsByTagName('*') as $node){
    for($i = $node->attributes->length -1; $i >= 0; $i--){
        $attribute = $node->attributes->item($i);
        if(!in_array($attribute->name,$allowed_attributes)) $node->removeAttributeNode($attribute);
    }
}

$html = $dom->saveHTML();

Result...

<p><a href="%5C%22http://example.com%5C%22">Link</a></p>

...

I tried html_entity_decode($html), but it doesn't work. I don't understand what is causing this problem. I could use some help.

I suspect the original `$string` that came from `$_POST` already contains those url-encoded characters. I don't think `DOMDocument` adds them. — Barmar, Jun 28 '17 at 22:18
I just tried the above code, it didn't produce any of the encoded characters. So the problem is with the value of `$string`. — Barmar, Jun 28 '17 at 22:22
Possible duplicate of [How to saveHTML of DOMDocument without HTML wrapper?](https://stackoverflow.com/questions/4879946/how-to-savehtml-of-domdocument-without-html-wrapper) — Amine Messaoudi, Jun 28 '17 at 22:30
When I remove the $dom,/DOMDocument section, the code returns the expected HTML string (even when provided by $_POST). — bookbinder, Jun 28 '17 at 22:40
No problems for me. After running your sample code in PHP 7, `$html` has a value of `
Link
` — miken32, Jun 28 '17 at 23:14

score 0 · Answer 1 · answered Mar 31 '20 at 14:02

I ran into this issue and question while working on a wordpress filter. I found in my case that the content was run through addslashes and the slashes were causing that return. The question above would look something like this.

$string = stripslashes('<p><a href="http://example.com">Link</a></p>'); // via $_POST['post-content']
$dom = new DOMDocument();
$dom->loadHTML($string);
$allowed_attributes = array('id','href', 'src', 'class', 'style', 'colspan', 'rowspan');
foreach($dom->getElementsByTagName('*') as $node){
    for($i = $node->attributes->length -1; $i >= 0; $i--){
       $attribute = $node->attributes->item($i);
        if(!in_array($attribute->name,$allowed_attributes)) $node->removeAttributeNode($attribute);
    }
}

// Dont forget to add the slashes back in
$html = addslashes($dom->saveHTML());

PHP DOMDocument returning quotation marks as special/HTML characters

1 Answers1