{"action":"created","issue":{"url":"https://api.github.com/repos/AuthorizeNet/sdk-php/issues/67","labels_url":"https://api.github.com/repos/AuthorizeNet/sdk-php/issues/67/labels{/name}","comments_url":"https://api.github.com/repos/AuthorizeNet/sdk-php/issues/67/comments","events_url":"https://api.github.com/repos/AuthorizeNet/sdk-php/issues/67/events","html_url":"https://github.com/AuthorizeNet/sdk-php/issues/67","id":102401888,"number":67,"title":"AuthorizeNet_Subscription is not escaping values for inclusion in XML","user":{"login":"JustAHappyKid","id":20557,"avatar_url":"https://avatars.githubusercontent.com/u/20557?v=3","gravatar_id":"","url":"https://api.github.com/users/JustAHappyKid","html_url":"https://github.com/JustAHappyKid","followers_url":"https://api.github.com/users/JustAHappyKid/followers","following_url":"https://api.github.com/users/JustAHappyKid/following{/other_user}","gists_url":"https://api.github.com/users/JustAHappyKid/gists{/gist_id}","starred_url":"https://api.github.com/users/JustAHappyKid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JustAHappyKid/subscriptions","organizations_url":"https://api.github.com/users/JustAHappyKid/orgs","repos_url":"https://api.github.com/users/JustAHappyKid/repos","events_url":"https://api.github.com/users/JustAHappyKid/events{/privacy}","received_events_url":"https://api.github.com/users/JustAHappyKid/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-21T15:16:27Z","updated_at":"2015-09-14T15:30:27Z","closed_at":null,"body":"If one needs to create a subscription for a credit-card registered to \"Jim & Jane Plain\", for example, this is problematic; invalid XML will be produced. The escaping should probably extend to every field that could conceivably have an ampersand, which would easily include company, address -- probably even country (though usually it's best to just escape everything for good measure).\r\n\r\nFor my purposes I only needed the name fields escaped (for now), so I patched my local copy of `AuthorizeNetTypes.php`, adding a method to `AuthorizeNet_Subscription` like this:\r\n\r\n    /**\r\n     * Escape the given string for inclusion in XML.\r\n     */\r\n    private function escape($s) {\r\n        return htmlspecialchars($s, ENT_QUOTES | ENT_XML1);\r\n    }\r\n\r\nThen I escape the values like this:\r\n\r\n    <firstName>{$this->escape($this->billToFirstName)}</firstName>\r\n    <lastName>{$this->escape($this->billToLastName)}</lastName>"},"comment":{"url":"https://api.github.com/repos/AuthorizeNet/sdk-php/issues/comments/140116463","html_url":"https://github.com/AuthorizeNet/sdk-php/issues/67#issuecomment-140116463","issue_url":"https://api.github.com/repos/AuthorizeNet/sdk-php/issues/67","id":140116463,"user":{"login":"schmich","id":1562839,"avatar_url":"https://avatars.githubusercontent.com/u/1562839?v=3","gravatar_id":"","url":"https://api.github.com/users/schmich","html_url":"https://github.com/schmich","followers_url":"https://api.github.com/users/schmich/followers","following_url":"https://api.github.com/users/schmich/following{/other_user}","gists_url":"https://api.github.com/users/schmich/gists{/gist_id}","starred_url":"https://api.github.com/users/schmich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/schmich/subscriptions","organizations_url":"https://api.github.com/users/schmich/orgs","repos_url":"https://api.github.com/users/schmich/repos","events_url":"https://api.github.com/users/schmich/events{/privacy}","received_events_url":"https://api.github.com/users/schmich/received_events","type":"User","site_admin":false},"created_at":"2015-09-14T15:30:27Z","updated_at":"2015-09-14T15:30:27Z","body":"I hit this issue as well. The onus of escaping input data should not be on clients of the library. It should be built into the library itself since the transport format (XML) is an implementation detail.\r\n\r\nThe workaround @JustAHappyKid mentions works, but it shouldn't be necessary. It would be good to see a fix here."}}