AbstractRequest.php Unescaped & in createElement()

[soeurdefeo]

The createElement() call in line 112 throws an warning (Warning: DOMDocument::createElement(): unterminated entity reference) and does not set ne child-node correct if you send e.g. for the errorURL an string with & because the value is not escaped by default in this method.
Please add before

$value = str_replace('&', '&', $value);

Similiar is already done in Mpay24Order.php __set() method line 176.

[stefanpolzer]

@soeurdefeo just replacing any & like so, involves some other risks e.g. if the string is already escaped like this: https://example.com/path?param1=value2&param2=value2
we end up with https://example.com/path?param1=value2&param2=value2.

I will check if there is a way where we can fix this without open a other issue as described.
I was not involved in the Mpay24Order::__set() method so I can not say if this is done right there.

[volkanakb]

@stefanpolzer what about using -> DOMDocument::createTextNode(html_entity_decode('https://example.com/path?param1=value2&param2=value2'));

[stefanpolzer]

@soeurdefeo can you check if this is now solved in the last PR #90 that was now merged into the master tree?

[mdaskalov]

doesn't work for me. Ampersand is never escaped.
It also doesn't work if you set again previously set Node:

$mdxi->Order->BillingAddr->Name = 'John > Doe';
$mdxi->Order->BillingAddr->Name = 'apos: \', quot: ", lt: <, amp: &, rt: >';

Best practice is to use createTextNode which escapes the text accordingly. I've started a new branch xml-escape to implement it using this method.

The question is if we could/should be backward compatible. If we have already escaped strings we shouldn't escape again otherwise we will have: & -> &

It would be difficult if we want to support both escaped and not escaped versions:

$mdxi->Order->TID = '< & >';
$mdxi->Order->UserField = '&lt;&amp;&gt;';

Maybe html_entity_decode with ENT_XML1 can be used to detect if already escaped...

Alternatively htmlentities could be used with the double_encode flag set to false:

       $value = htmlentities($value, ENT_XML1, "UTF-8", false);