Fixed bug #32608 (html_entity_decode() converts single quotes even if

ENT_NOQUOTES is given).

diff --git a/ext/standard/html.c b/ext/standard/html.c
index 615eb476898b92a118db69b05382b8ac81c97fde..a50f1fd4f39d40c4448cab8382dc0889dcb3f82a 100644 (file)
--- a/ext/standard/html.c
+++ b/ext/standard/html.c
@@ -996,7 +996,11 @@ PHPAPI char *php_unescape_html_entities(unsigned char *old, int oldlen, int *new
                                                                if ((code >= 0x80 && code < 0xa0) || code > 0xff) {
                                                                        invalid_code = 1;
                                                                } else {
-                                                                       *(q++) = code;
+                                                                       if (code == 39 || !quote_style) {
+                                                                               invalid_code = 1;
+                                                                       } else {
+                                                                               *(q++) = code;
+                                                                       }
                                                                }
                                                                break;