[BUGFIX] Do not escape characters that do not need escaping in CSS string #1444

8ctopus · 2025-12-25T10:25:55Z

Add draft to attempt to resolve #1443

There are no specific tests yet, and there are improvements that can be made, I just want to get your approval before I polish things up.

coveralls · 2025-12-25T10:27:36Z

coverage: 70.775% (+0.3%) from 70.514%
when pulling 0d120d5 on 8ctopus:css-string-escaping
into 6f07de2 on MyIntervals:main.

JakeQZ

I think it could be significantly slower looping through the string rather than using the built-in function (particularly as some strings may be base64-encoded images). Also this is reimplementing some of what addslashes() does.

Wouldn't it be simpler (and more efficient) to use addslashes() as before, then do a str_replace() to replace \' with ' or \" with " depending on the string quoting type?

JakeQZ · 2025-12-30T01:04:52Z

Wouldn't it be simpler (and more efficient) to use addslashes() as before, then do a str_replace() to replace \' with ' or \" with " depending on the string quoting type?

PS. I agree with adding a separate method to do this.

8ctopus · 2026-01-07T06:35:02Z

Updated according to your feedback.

oliverklee · 2026-01-07T08:41:47Z

@8ctopus Thanks! Could you please rebase?

8ctopus · 2026-01-07T08:53:19Z

done

oliverklee · 2026-01-07T09:11:29Z

Thanks! GitHub is still showing merge conflicts. Could you please have a look?

8ctopus · 2026-01-07T10:28:26Z

now should be good.

oliverklee · 2026-01-07T11:09:01Z

Thanks! Now GitHub was able to run the CI jobs.

The PHP-CS-Fixer job suggests some improvements. Could you please apply those to get the build green? Thanks!

8ctopus · 2026-01-08T08:04:11Z

This time all tests are green, I also added a test to check that we do not escape when not necessary.

oliverklee · 2026-01-08T09:29:25Z

Thanks!

JakeQZ

This looks generally good now.

However, looking at the tests, there don't seem to be any covering that double-quotes within a single-quoted string are no longer escaped, e.g. if string quoting type is ', the quotes in "Hello World" don't need escaping and the result should be '"Hello World"'. Could you add a test for that?

I've suggested a couple of improvements, and a further correction to a comment that was previously wrong.

I'm not sure whether we have a project preference for string concatenation vs interpolation, so am asking @oliverklee for comment...

tests/fixtures/unicode.css

JakeQZ · 2026-01-08T23:40:44Z

tests/Unit/Value/CSSStringTest.php

+        $input = "data:image/svg+xml,%3Csvg width='24' height='24' viewBox='0 0 24 24' fill='none'" .
+        " xmlns='http://www.w3.org/2000/svg'%3E%3Cpath fill-rule='evenodd' clip-rule='evenodd'" .
+        " d='M14.3145 2 3V11.9987H17.5687L18 8.20761H14.3145L14.32 6.31012C14.32 5.32134 14.4207" .
+        ' 4.79153 15.9426 4.79153H17.977V1H14.7223C10.8129 1 9.43687 2.83909 9.43687 ' .
+        " 5.93187V8.20804H7V11.9991H9.43687V23H14.3145Z' fill='black'/%3E%3C/svg%3E%0A";


Autoformatting may apply some indentation, but I suggest leaving it as is for now. @oliverklee can run the autoformatter he uses as a post-PR (I think it's part of PHPStorm, which I don't have, and even if you have it, you may not have the same configuration set-up).

tests/Unit/Value/CSSStringTest.php

src/Value/CSSString.php

tests/Unit/Value/CSSStringTest.php

8ctopus · 2026-01-09T05:31:01Z

However, looking at the tests, there don't seem to be any covering that double-quotes within a single-quoted string are no longer escaped, e.g. if string quoting type is ', the quotes in "Hello World" don't need escaping and the result should be '"Hello World"'. Could you add a test for that?

done

oliverklee · 2026-01-09T09:09:15Z

I'm not sure whether we have a project preference for string concatenation vs interpolation,

For new/updated code, we prefer string concatenation over interpolation (without having a hard-and-fast rule, though).

src/Value/CSSString.php

tests/Unit/Value/CSSStringTest.php

JakeQZ

looking at the tests, there don't seem to be any covering that double-quotes within a single-quoted string are no longer escaped

done

Thanks for your perseverence <3

I've made a suggestion for what the additional test should cover (to be consistent with the first test for single quotes), and for the test method naming. (The comments appear in order of writing in the Conversation tab, and should be read in that order, which is not in the order of the code. Hope that makes sense and they make sense.)

The code change suggested includes avoiding string interpolation in the one instance covered, though that would still need to resolved in the other three instances as per @oliverklee's comments.

tests/Unit/Value/CSSStringTest.php

JakeQZ

There seems to be an extra blank line in a test method, otherwise this looks good to go now.

tests/Unit/Value/CSSStringTest.php

JakeQZ

I've spotted an issue with the changelog change that I previously missed. Another suggestion could also be included in this PR.

JakeQZ · 2026-01-17T23:53:23Z

src/Value/CSSString.php

    {
-        $string = \addslashes($this->string);
+        $string = $this->escape($this->string, $outputFormat->getStringQuotingType());
        $string = \str_replace("\n", '\\A', $string);


We should move this to the new escape method as a post-PR. Or maybe it can be done as part of this PR, as I've just spotted an issue with the changelog that also needs resolving.

I'd prefer to have this as a post-PR cleanup as I still don't fully understand the \\A thing.

JakeQZ · 2026-01-18T00:04:53Z

CHANGELOG.md

+## 9.2.0:
+
+### Fixed
+
+- Do not escape characters that do not need escaping in CSS string (#1444)
+


I've just spotted that this is in the wrong place (it should be added at the top of the 'Fixed' section above), and that the '9.2.0' heading shouldn't be created yet - we do that when we actually cut the release.

…tring

Co-authored-by: JakeQZ <[email protected]>

oliverklee added the bug label Dec 25, 2025

oliverklee assigned 8ctopus Dec 25, 2025

oliverklee added this to the 9.2.0: New features, bug fixes and deprecations milestone Dec 25, 2025

JakeQZ reviewed Dec 29, 2025

View reviewed changes

8ctopus force-pushed the css-string-escaping branch from 2a66812 to 47970ab Compare January 7, 2026 08:52

8ctopus force-pushed the css-string-escaping branch from 47970ab to 676dd8c Compare January 7, 2026 10:27

JakeQZ requested changes Jan 9, 2026

View reviewed changes

JakeQZ requested a review from oliverklee January 9, 2026 00:36

JakeQZ reviewed Jan 9, 2026

View reviewed changes

tests/Unit/Value/CSSStringTest.php Outdated Show resolved Hide resolved

oliverklee changed the title ~~Do not escape characters that do not need escaping in CSS string~~ [BUGFIX] Do not escape characters that do not need escaping in CSS string Jan 9, 2026

oliverklee requested changes Jan 9, 2026

View reviewed changes

src/Value/CSSString.php Outdated Show resolved Hide resolved

tests/Unit/Value/CSSStringTest.php Show resolved Hide resolved

JakeQZ requested changes Jan 9, 2026

View reviewed changes

tests/Unit/Value/CSSStringTest.php Outdated Show resolved Hide resolved

tests/Unit/Value/CSSStringTest.php Outdated Show resolved Hide resolved

tests/Unit/Value/CSSStringTest.php Outdated Show resolved Hide resolved

oliverklee requested a review from JakeQZ January 17, 2026 09:46

oliverklee approved these changes Jan 17, 2026

View reviewed changes

oliverklee force-pushed the css-string-escaping branch from 2427608 to c30444d Compare January 17, 2026 09:53

oliverklee approved these changes Jan 17, 2026

View reviewed changes

JakeQZ requested changes Jan 17, 2026

View reviewed changes

tests/Unit/Value/CSSStringTest.php Show resolved Hide resolved

oliverklee requested a review from JakeQZ January 17, 2026 23:41

JakeQZ requested changes Jan 18, 2026

View reviewed changes

8ctopus and others added 14 commits January 18, 2026 12:06

[FEATURE] Do not escape characters that do not need escaping in CSS s…

c8b4e76

…tring

[TASK] Cleanup code formatting

be7ede6

[TASK] Add do not escape characters that do not need escaping test

1aa4926

[TASK] Cleanup code formatting

1611d76

[TASK] Cleanup code formatting

99d61b3

[TASK] Clean up code

c942c34

[TASK] Add one more test to test css string escaping

ce0f031

Switch to addclashes

cfad5c5

Update tests/Unit/Value/CSSStringTest.php

a7b65ba

Co-authored-by: JakeQZ <[email protected]>

Update tests/Unit/Value/CSSStringTest.php

69e1ce1

Co-authored-by: JakeQZ <[email protected]>

Update tests/Unit/Value/CSSStringTest.php

e01569e

Co-authored-by: JakeQZ <[email protected]>

Fix formatting

3f03f43

Narrow type

a23c5be

Update tests/Unit/Value/CSSStringTest.php

56e605e

Co-authored-by: JakeQZ <[email protected]>

oliverklee force-pushed the css-string-escaping branch from 2b305ac to 56e605e Compare January 18, 2026 11:06

Keep changelog entry in the not-yet-released release

0d120d5

oliverklee requested a review from JakeQZ January 18, 2026 11:12

oliverklee approved these changes Jan 18, 2026

View reviewed changes

oliverklee mentioned this pull request Jan 18, 2026

Move newline escaping in CSSString into escape() #1466

Closed

JakeQZ approved these changes Jan 18, 2026

View reviewed changes

JakeQZ merged commit b36a6ac into MyIntervals:main Jan 18, 2026
24 checks passed

[BUGFIX] Do not escape characters that do not need escaping in CSS string #1444

[BUGFIX] Do not escape characters that do not need escaping in CSS string #1444

Uh oh!

Conversation

8ctopus commented Dec 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coveralls commented Dec 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JakeQZ left a comment

Choose a reason for hiding this comment

Uh oh!

JakeQZ commented Dec 30, 2025

Uh oh!

8ctopus commented Jan 7, 2026

Uh oh!

oliverklee commented Jan 7, 2026

Uh oh!

8ctopus commented Jan 7, 2026

Uh oh!

oliverklee commented Jan 7, 2026

Uh oh!

8ctopus commented Jan 7, 2026

Uh oh!

oliverklee commented Jan 7, 2026

Uh oh!

8ctopus commented Jan 8, 2026

Uh oh!

oliverklee commented Jan 8, 2026

Uh oh!

JakeQZ left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

JakeQZ Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

8ctopus commented Jan 9, 2026

Uh oh!

oliverklee commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JakeQZ left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JakeQZ left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

JakeQZ left a comment

Choose a reason for hiding this comment

Uh oh!

JakeQZ Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

oliverklee Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

oliverklee Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

JakeQZ Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

oliverklee Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

8ctopus commented Dec 25, 2025 •

edited

Loading

coveralls commented Dec 25, 2025 •

edited

Loading

JakeQZ left a comment •

edited

Loading

oliverklee commented Jan 9, 2026 •

edited

Loading

JakeQZ left a comment •

edited

Loading

JakeQZ left a comment •

edited

Loading