Fixed bug #40637 (Regression in strip_tags() in relation so quote handling)

diff --git a/ext/standard/string.c b/ext/standard/string.c
index a82aa0c34f51859babd07e83783dfdee1e1d9763..c65da880877a28a7fd2f596d01e4f0ddab44e0b7 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4263,8 +4263,12 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
                                        tp = ((tp-tbuf) >= PHP_TAG_BUF_SIZE ? tbuf: tp);
                                        *(tp++) = c;
                                }
-                               if (p != buf && *(p-1) != '\\') {
-                                       in_q = !in_q;
+                               if (p != buf && *(p-1) != '\\' && (!in_q || *p == in_q)) {
+                                       if (in_q) {
+                                               in_q = 0;
+                                       } else {
+                                               in_q = *p;
+                                       }
                                }
                                break;