MyBB Community Forums

PHP Version: 5.2.8
SQL Engine: MySQL 5.0.77
MyBB Version: 1.4.6

Description: As outlined below, unicode that is encapsulated within the [ CODE ] block is not being escaped. Below is a copy/paste of a post by one of my forum admins who discovered this bug.

EDIT: When editing a post with unicode in it, it isn't being escaped. I'm not sure where in the posting process the code gets "eaten".

Example:

Testing "non breaking space", as example...

Entity (&nbsp):

 

Unicode ( ):

Hex ( ):

 

Conclusion:
- Entity does work but isn't supported in XHTML.
- Unicode doesn't work (supported in all browsers I know, down to NN4).
- Hex does work, I'm not up to date about browser compatibility.

Screenshot: http://img341.imageshack.us/img341/3905/example.png

number entities are parsed by the MyBB parser -   and others aren't parsed

Thanks for the reply.

I figured out a solution:

Fixed the display by commenting out the following line in inc/class_parser.php:

$message = preg_replace("#&(?!\#[0-9]+;)#si", "&", $message); // fix & but allow unicode

and adding after:

$message = str_replace('&', '&', $message);

Fixed the editing portion by commenting out the following line in inc/functions.php:

$message = preg_replace("#&(?!\#[0-9]+;)#si", "&", $message); // Fix & but allow unicode

and adding after:

$message = str_replace('&', '&', $message);