ampersand (&) in HTML corrupts word document file

[silverbackdan]

This is:

• a bug report
• a feature request
• not a usage question (ask them on https://stackoverflow.com/questions/tagged/phpword)

Expected Behavior

Correct generation of a word file

Current Behavior

A word file is generated but cannot be opened because it is corrupted.

Failure Information

When adding HTML, if there is an ampersand (just an & character) the output document is corrupt. It is required to turn the ampersand into html encoded &

How to Reproduce

$section = $this->phpWord->addSection();
Html::addHtml($section, '&', false, false);

Context

• PHP version: 7.2.7
• PHPWord version: 0.15

EDIT:
My mistake - reproduction can be with either

Html::addHtml($section, '&', false, false);

OR

Html::addHtml($section, '&', false, false);

HTML character codes such as " work fine

[silverbackdan]

I've had a quick look and the html normalization seems a little too simplistic as well.

Instead of
$html = str_replace('&', '&', $html); how about something like $html = preg_replace('/(&)(?![0-9a-z]+;)/i', '&', $html); This way you will not catch html characters already defined. TBH I'm still not really sure why the ampersand causes this issue. Does it need to be escaped further down the line when inserting into the word document format?

EDIT
Another bug is present in the addText method.
$section->addText('&'); causes the issue, $section->addText('&'); does not. I think I'm nearing a solution here hopefully.

[troosan]

The following is normal it fails, as this is not valid HTML.

Html::addHtml($section, '&', false, false);

The following works fine

Html::addHtml($section, '&', false, false);

As for the bug with the addText function, indeed, this should be escaped when writing to XML, but I don't think the Element/Text class is the place to do this. You will break the RTF writer. This should be escaped in the Word2007 writer instead.

[silverbackdan]

When the dom element is created in php, & is converted to just & so there's no getting around it I don't think. There is a normalization attempt made already that I spotted but it is reverted when getting the html from the php dom element.

I am not sure what the final document formats look like, I've not researched that before so am not sure what breaking changes there are between output formats. Could you link me to the function that you'd like me to move the fix to? I'm happy to do that if you'd like - I'm also not precious about the fix should you want to move it to where you think it is most appropriate.

Thanks for your time on this.

[jeromeWeissmann]

Hi, got the same error here.
I've tried the fallowing:
Html::addHtml($this->section, "Hello & Bye");
Or
Html::addHtml($this->section, "Hello & Bye");

docx file is corrupt in both cases.

[jeromeWeissmann]

After looking for more information, found that use
\PhpOffice\PhpWord\Settings::setOutputEscapingEnabled(true);
fix the problem

[silverbackdan]

Oh wow, that's a bit strange - I wonder why a user would not escape the output, are there any side-effects?

[troosan]

@silverbackdan Indeed, ideally, the setting should be set to true by default.
This was not done for backward compatibility reasons. Maybe this could be changed in version 1.0

[margori]

I confirm this bug.

[davidcheal]

I realise this is an old bug, but I spent a couple of hours chasing it today so thought I'd resurface it. if I send '&' in the html it should go all the way through to Word, but it gets converted back to a '&' and in a Word doc that corrupts it.

I tried finding how the conversion happens, but cant work it out. I can see the '&' in the html at line 82 of Html.php, but in the call to parseNode it is suddenly a '&'.

setOutputEscapingEnabled(true); does solve the issue though.