这个php RSS提要有什么问题？

Question

This is the code I am using:

<?php
include "global.php";

$query = "SELECT * FROM posts WHERE `approved`='1' ORDER BY time DESC";
$res = mysql_query($query) or die(mysql_error());

$xml_output = "<?xml version=\"1.0\"?>
";
$xml_output .= "<rss version=\"2.0\">

";
$xml_output .= "<channel>

";

while($row = mysql_fetch_assoc($res)){
    $id = $row['id'];
    $title = $row['title'];
    $content = ShortenText($row['content'], 500);

    $xml_output .= "\t<item>
";
    $xml_output .= "\t\t<title>" . $title . "</title>
";
        $content = str_replace("&", "&", $content);
        $content = str_replace("<", "<", $content);
        $content = str_replace(">", "&gt;", $content);
        $content = str_replace("\"", "&quot;", $content);
    $xml_output .= "\t\t<description>" . $content . "</description>
";
    $xml_output .= "\t\t<link>" . "http://projectstratos.com/post.php?id=" . $row['id'] . "</link>
";
    $xml_output .= "\t</item>
";
}

$xml_output .= "</channel>

"; 
$xml_output .= "</rss>";

echo $xml_output;
?>

And it shows a blank rss feed page, why is this?

Answer 1

The problem is because you aren't correctly escaping the XML here:

$content = str_replace("&", "&", $content);
$content = str_replace("<", "<", $content);

These two lines aren't actually doing anything. You are just replacing a string with the same string. Did you mean & instead of & and < instead of < for the replacement strings?

A better way is to use CDATA tags but this still won't escape all characters correctly.

Even better still - use the DOM classes to generate the XML for you rather than escaping it yourself.