Phpword: Requirement to use htmlspecialchars() everywhere

[igorsantos07]

Shouldn't content escaping be automatic, so we don't have to exactly remember DOCX is a XML file and manually escape our content before placing into the file? It's quite annoying having to run everything on htmlspecialchars() to avoid weird errors when opening the file. This is worse when you have user input :/

On a side note, this is not needed on the sister project PHPExcel, even on XLSX, so I think this should be the default behavior here as well?

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[str]

+1

[JakeQZ]

Since PHPWord 0.13.0 (I believe) you can use

\PhpOffice\PhpWord\Settings::setOutputEscapingEnabled(true);

which should do the trick. I don't know about PHPExcel.

[CHOUKI-Mouhssine]

@JakeQZ : thank you