From: [EMAIL PROTECTED] Operating system: WinXP SP1 and FreeBSD 4.9 PHP version: 4.3.4 PHP Bug Type: Session related Bug description: SID put in the wrong place in anchors containing only HTML entities
Description: ------------ If you have an anchor, whose href is comprised ONLY of HTML entities - a common spam bot deterrent now - the SID is placed after the & from the first entity, breaking the URI. Also, if the entities are decoded to "mailto:" links, the SID should not be appended at all... Is it possible to decode before trying to add the SID and then re-HTMLentities? Reproduce code: --------------- <?php session_start(); ?> // Link to mailto:[EMAIL PROTECTED] <a href="mailto:davey@php.net">davey@php.net</a> // Link to http://php.net <a href="http://php.net">php.net</a> Expected result: ---------------- <a href="mailto:davey@php.net">davey@php.net</a> <a href="http://php.net?PHPSESSID=SID">php.net</a> Actual result: -------------- <a href="&?PHPSESSID=d4030b2d6c97a1425c49071bf8b2ab5a#109;ailto:davey@php.net">davey@php.net</a> <a href="&?PHPSESSID=d4030b2d6c97a1425c49071bf8b2ab5a#104;ttp://php.net">php.net</a> -- Edit bug report at http://bugs.php.net/?id=27158&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=27158&r=trysnapshot4 Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=27158&r=trysnapshot5 Fixed in CVS: http://bugs.php.net/fix.php?id=27158&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=27158&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=27158&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=27158&r=needscript Try newer version: http://bugs.php.net/fix.php?id=27158&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=27158&r=support Expected behavior: http://bugs.php.net/fix.php?id=27158&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=27158&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=27158&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=27158&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=27158&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=27158&r=dst IIS Stability: http://bugs.php.net/fix.php?id=27158&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=27158&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=27158&r=float