OK so this function htmlspecialchars has a variable new which is supposed to hold the size update after a character is escaped. Is it just me or does saying strlen(entity) increase it forgetting that the escaped character is already counted in old?

1 Answer 1


Since you asked: it's just you. It's not forgetting the escaped character, it's using that already-allocated space. A string needs to be allocated such that there is room for the null terminator. In the example where s = "&": new = strlen(s) = 1; strlen("&") = 5; so t is malloc'd for 6. Which is how much memory is required for a string of length 5.

  • oooh.. OK thanks a bunch
    – karuhanga
    Jun 9, 2016 at 17:58
  • wait a sec... so I took a second look and now am wondering from your example, if Ur appending a new string, it means this time, a \0 exists already... could you please clarify?
    – karuhanga
    Jun 13, 2016 at 1:22
  • man strcat says :The strcat() function appends the src string to the dest string, overwriting the terminating null byte ('\0') at the end of dest, and then adds a terminating null byte. Jun 13, 2016 at 12:11
  • exactly my point... if it's being overwritten, what's the point of allocating that extra+1 space as in Ur example earlier
    – karuhanga
    Jun 14, 2016 at 4:04
  • 1
    I should have said new + strlen(entity) + 1 - 1 in the previous comment. new is the length of t. We are adding strlen(entity) chars, so new = new + strlen(entity). But one of those chars is already included, so new = new + strlen(entity) - 1. Finally, the realloc must allocate for the null byte so new = new + strlen(entity) - 1 + 1. -1 + 1 is a wash, so it is correct to reallocate t for new + strlen(entity). Jun 14, 2016 at 17:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .