RSS feed：htmlspecialchars（）与CDATA

Question

i've written a little class in PHP to generate a simple RSS feed.

The item description should also be able to contain html tags.

I've wondered which one is the better way and what are the advantages/disadvantages of each method:

$item .= "<description><![CDATA[" . $description . "]]></description>
";

or

$item .= "<description>" . htmlspecialchars($description, ENT_NOQUOTES, "UTF-8") . "</description>
";

The only disadvantage of the CDATA method i can think of is, that i've to check in advance if the string $description contains

"<![CDATA[" or "]]>".

Thanks in advance for clarification.

Answer 1

There is only 1 choice when you want to use HTML-code there, the CDATA-section.

The reason: The feed must be valid XML, but HTML may not be valid XML. So if you use HTML without CDATA, everything inside the description that is not valid XML will result in a XML-Parser-Error. This may already be forced by such a simple thing like   or <br> (what is valid HTML, but invalid XML)

CDATA-sections will not be parsed, so you can use there what you want to.

But however, you better use <content:encoded> for markup.

• https://developer.mozilla.org/en-US/docs/RSS/Article/Why_RSS_Content_Module_is_Popular_-_Including_HTML_Contents

• Difference between description and content:encoded tags in RSS2