Fixed bug #45581 (htmlspecialchars() double encoding &#x hex items)

ext/standard/html.c

@@ -1197,9 +1197,20 @@ encode_amp:
 					} else {
 						if (*s == '#') { /* numeric entities */
 							s++;
-							while (s < e) {
-								if (!isdigit(*s++)) {
-									goto encode_amp;
+							/* Hex (&#x5A;) */
+							if (*s == 'x' || *s == 'X') {
+								s++;
+								while (s < e) {
+									if (!isxdigit(*s++)) {
+										goto encode_amp;
+									}
+								}
+							/* Dec (&#90;)*/
+							} else {
+								while (s < e) {
+									if (!isdigit(*s++)) {
+										goto encode_amp;
+									}
 								}
 							}
 						} else { /* text entities */

ext/standard/tests/strings/htmlentities18.phpt

@@ -6,7 +6,8 @@ $tests = array(
 	"abc",
 	"abc&sfdsa",
 	"test+s & some more D",
-	"&; &amp &#a; &9;",
+	"test+s & some more D",
+	"&; &amp &#a; &9; &#xyz;",
 	"&kffjadfdhsjfhjasdhffasdfas;",
 	"&#8787978789",
 	"&",
@@ -26,8 +27,10 @@ unicode(13) "abc&sfdsa"
 unicode(13) "abc&sfdsa"
 unicode(33) "test+s & some more D"
 unicode(33) "test+s & some more D"
-unicode(24) "&; &amp &#a; &9;"
-unicode(24) "&; &amp &#a; &9;"
+unicode(34) "test+s & some more D"
+unicode(34) "test+s & some more D"
+unicode(35) "&; &amp &#a; &9; &#xyz;"
+unicode(35) "&; &amp &#a; &9; &#xyz;"
 unicode(32) "&kffjadfdhsjfhjasdhffasdfas;"
 unicode(32) "&kffjadfdhsjfhjasdhffasdfas;"
 unicode(16) "&#8787978789"