Refs #1517: only encode <,>, and & for strings in xml

git-svn-id: http://code.elgg.org/elgg/trunk@3961 36083f99-b078-4883-b0ff-0f9b5a30f544

diff --git a/engine/lib/xml.php b/engine/lib/xml.php
index cbc93655566681c0278595be8172270894cbb25e..f691b2475e58a8c3c0530fd3becb24c8ede3e32a 100644 (file)
--- a/engine/lib/xml.php
+++ b/engine/lib/xml.php
@@ -58,7 +58,7 @@
                        } else if (gettype($value) == "boolean") {
                                $output .= $value ? "true" : "false";
                        } else {
-                               $output .= htmlentities($value);
+                               $output .= htmlspecialchars($value, ENT_NOQUOTES, 'UTF-8');
                        }
                        
                        $output .= "</$key>\n";
@@ -103,7 +103,7 @@
                        } else if (gettype($value) == "boolean") {
                                $output .= $value ? "true" : "false";
                        } else {
-                               $output .= htmlentities($value);
+                               $output .= htmlspecialchars($value, ENT_NOQUOTES, 'UTF-8');
                        }
                        
                        $output .= "</$item>\n";