Description

xmlNodeSetContent decodes character and entity references which is typically not what users expect. This can be worked around by first calling xmlNodeSetContent with a NULL pointer to clear the node and then using xmlNodeAddContent which adds the string verbatim.

Here's an example:

<?php
$doc = new DOMDocument();
$doc->loadXML("<!DOCTYPE doc [ <!ENTITY e 'ent'> ]><doc/>");
$root = $doc->documentElement;
$root->nodeValue = "&lt; &e; &gt;";
echo($root->nodeValue); # prints "< ent >"

PHP Version

All versions

Operating System

No response