{"action":"opened","issue":{"url":"https://api.github.com/repos/AuthorizeNet/sdk-php/issues/67","labels_url":"https://api.github.com/repos/AuthorizeNet/sdk-php/issues/67/labels{/name}","comments_url":"https://api.github.com/repos/AuthorizeNet/sdk-php/issues/67/comments","events_url":"https://api.github.com/repos/AuthorizeNet/sdk-php/issues/67/events","html_url":"https://github.com/AuthorizeNet/sdk-php/issues/67","id":102401888,"number":67,"title":"AuthorizeNet_Subscription is not escaping values for inclusion in XML","user":{"login":"JustAHappyKid","id":20557,"avatar_url":"https://avatars.githubusercontent.com/u/20557?v=3","gravatar_id":"","url":"https://api.github.com/users/JustAHappyKid","html_url":"https://github.com/JustAHappyKid","followers_url":"https://api.github.com/users/JustAHappyKid/followers","following_url":"https://api.github.com/users/JustAHappyKid/following{/other_user}","gists_url":"https://api.github.com/users/JustAHappyKid/gists{/gist_id}","starred_url":"https://api.github.com/users/JustAHappyKid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JustAHappyKid/subscriptions","organizations_url":"https://api.github.com/users/JustAHappyKid/orgs","repos_url":"https://api.github.com/users/JustAHappyKid/repos","events_url":"https://api.github.com/users/JustAHappyKid/events{/privacy}","received_events_url":"https://api.github.com/users/JustAHappyKid/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-08-21T15:16:27Z","updated_at":"2015-08-21T15:16:27Z","closed_at":null,"body":"If one needs to create a subscription for a credit-card registered to \"Jim & Jane Plain\", for example, this is problematic; invalid XML will be produced. The escaping should probably extend to every field that could conceivably have an ampersand, which would easily include company, address -- probably even country (though usually it's best to just escape everything for good measure).\r\n\r\nFor my purposes I only needed the name fields escaped (for now), so I patched my local copy of `AuthorizeNetTypes.php`, adding a method to `AuthorizeNet_Subscription` like this:\r\n\r\n    /**\r\n     * Escape the given string for inclusion in XML.\r\n     */\r\n    private function escape($s) {\r\n        return htmlspecialchars($s, ENT_QUOTES | ENT_XML1);\r\n    }\r\n\r\nThen I escape the values like this:\r\n\r\n    <firstName>{$this->escape($this->billToFirstName)}</firstName>\r\n    <lastName>{$this->escape($this->billToLastName)}</lastName>"}}