Adding a value that contains "&" in a template breaks it

[jdespatis]

I'm using the template stuff in order to replace some values, but the following code breaks the template (anything in the template after the & symbol is not shown):

        $document = $PHPWord->loadTemplate($templatePath);
        $document->setValue('type', "some value & foobar");

I guess the & is a specific character in xml word files, like it can be in html

The workaround I'm currently using is to wrap the value into an htmlspecialchars and all is ok afterwards:

        $document = $PHPWord->loadTemplate($templatePath);
        $document->setValue('type', htmlspecialchars("some value & foobar"));

=> why not add this htmlspecialchars right into the setValue function ?

Thanks for your feedback

[Progi1984]

htmlspecialchars change (&, ', ", <, >) by theirs HTML equivalents.

After having inserted some texts in a DOCX file, i confirm the need of use of htmlspecialchars :

<w:p>
  <w:pPr>
    <w:pStyle w:val="style0"/>
    <w:rPr><w:rFonts w:cs="Mangal" w:eastAsia="SimSun"/></w:rPr>
  </w:pPr>
  <w:r>
    <w:rPr></w:rPr>
    <w:t>Texte&amp;Texte</w:t>
  </w:r>
  <w:r>
    <w:rPr></w:rPr>
    <w:t>&apos;Texte</w:t>
  </w:r>
  <w:r>
    <w:rPr></w:rPr>
    <w:t>&quot;</w:t>
  </w:r>
  <w:r>
    <w:rPr></w:rPr>
    <w:t>Texte&lt;Texte&gt;Texte</w:t>
  </w:r>
</w:p>

[Progi1984]

Fixed in develop branch

[jdespatis]

I've tested this with last dev-master (38d3d7b), it works like a charm

Thanks!

Guys, I wouldn't agree with you.

First, as for me, I escape data before exporting it in any format (HTML, OOXML, no matter). Second time escaping brokes my data.

Second, there are already tons of libraries which offer escaping functionality (e.g. Zend/Escaper). And they are pretty good. Data escaping is much more than single htmlspecialchars call which we have here.

As regards escaping strategy. Output should be escaped and everybody knows this. Escaping should be performed after all data transformations. It's a well-known rule too. PhpWord is a library which helps to build OOXML (and other) documents, based on the provided data. It doesn't change the data, it just packs the data into another format. There are also libraries which help to build HTML pages. So, if we escape data before submitting to HTML builders, why not to escape data before submitting to PhpWord? I don't see any difference here. And my applications goes this way. I can support tons of different formats and escape only once and in one place. Morever, there is no need to implement the same escaping functionality in all libraries for all formats of documents. Just escape data out of the library. Remember: escape once, use multiple times. :)

So, I'm gonna to remove the htmlentities call. Any objections?