Always emit single quotes as '

See php/php-src#6583

Author: thekid

ChangeLog.md

@@ -3,6 +3,13 @@ Mustache for XP Framework ChangeLog
 
 ## ?.?.? / ????-??-??
 
+## 7.0.0 / 2021-05-02
+
+* Changed single quotes to be emitted as `'` for all PHP versions.
+  This breaks backwards compatiblity but ensure there are no security
+  risks with expressions such as `<a href='{{url}}'>...</a>`.
+  (@thekid)
+
 ## 6.1.2 / 2021-05-02
 
 * Fixed single quotes being output as `&#039;` in PHP 8.1, which changed

src/main/php/com/github/mustache/IteratorNode.class.php

@@ -48,7 +48,7 @@ public function write($context, $out) {
     } else {
       $v= $value;
     }
-    $out->write($this->escape ? htmlspecialchars($v, ENT_COMPAT) : $v);
+    $out->write($this->escape ? htmlspecialchars($v, ENT_QUOTES | ENT_SUBSTITUTE) : $v);
   }
 
   /**

src/main/php/com/github/mustache/VariableNode.class.php

@@ -93,7 +93,7 @@ public function write($context, $out) {
     } else {
       $rendered= $context->asString($value);
     }
-    $out->write($this->escape ? htmlspecialchars($rendered, ENT_COMPAT) : $rendered);
+    $out->write($this->escape ? htmlspecialchars($rendered, ENT_QUOTES | ENT_SUBSTITUTE) : $rendered);
   }
 
   /**

src/test/php/com/github/mustache/unittest/RenderingTest.class.php

@@ -60,12 +60,12 @@ public function html_is_escaped() {
     );
   }
 
-  #[Test, Values(map: ['"' => '&quot;', '<' => '&lt;', '>' => '&gt;', '&' => '&amp;', "'" => "'"])]
+  #[Test, Values(map: ['"' => '&quot;', '<' => '&lt;', '>' => '&gt;', '&' => '&amp;', "'" => "&#039;"])]
   public function html_special_chars_for_variables($chars, $expected) {
     Assert::equals($expected, $this->render('{{input}}', ['input' => $chars]));
   }
 
-  #[Test, Values(map: ['"' => '&quot;', '<' => '&lt;', '>' => '&gt;', '&' => '&amp;', "'" => "'"])]
+  #[Test, Values(map: ['"' => '&quot;', '<' => '&lt;', '>' => '&gt;', '&' => '&amp;', "'" => "&#039;"])]
   public function html_special_chars_for_iterator($chars, $expected) {
     Assert::equals($expected, $this->render('{{#input}}{{.}}{{/input}}', ['input' => [$chars]]));
   }