Codefilter does not escape php close tags when they exist in a string.

For example, the following code contains a php close tag within a string. This code should be printed literally but instead closes the php block.

$output = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n";

Comments

tangent’s picture

tangent commented
Priority: Normal » Critical

Changing the priority of this issue since it breaks the filter (if not the website).

Steven’s picture

Steven commented
Priority: Critical » Normal

Actually this problem is caused by the "&lt?xml" tag, which is seen as a shorthand for php's tag (<?). Mixing code blocks and php blocks is not supported. I did change the filter so it only allows <?php and not <?, as XML/SGML is a common use case.

In any case, end XML tags inside PHP will still cause problems because I have to use non-greedy matching to allow for more than one code block in a piece of text. And I'm not going to write an entire PHP parser for this.