Description

The following code:

<?php
	$x = xml_parser_create_ns( 'utf-8' );
	xml_set_default_handler( $x, function( $p, $data ) { echo $data; } );
	xml_parse( $x, "<foo attr1='\"&lt;&quot;' attr2=\"&quot;&lt;\"></foo>" , true );

Resulted in this output:

<foo attr1=""<"" attr2=""<"></foo>

But I expected this output instead:

<foo attr1="&quot;&lt;&quot;" attr2="&quot;&lt;"></foo>

Note: This requires you to compile php without expat. If expat support is compiled in, then the bug does not happen.

Basically, attributes with " or < get mangled resulting in invalid XML.

Relevant code seems to be https://github.com/php/php-src/blob/master/ext/xml/compat.c#L61

PHP Version

PHP 8.4.14 (cli) (built: Nov  8 2025 21:25:55) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.14, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.14, Copyright (c), by Zend Technologies

Operating System

No response