PHP中安全生成HTML注释的策略：避免嵌套与解析错误

function show_html_comment($comment)
{
   echo '<!-- ' . $comment . ' -->';
}

<!-- <!-- foo --> -->

<?php
function show_html_comment_cleaned($comment)
{
    // 移除内容中的HTML注释起始和结束标记
    $comment = str_replace('<!--', '', $comment);
    $comment = str_replace('-->', '', $comment);
    // 使用 trim() 移除可能因替换而产生的多余空白
    echo '<!-- ' . trim($comment) . ' -->';
}

// 示例用法
$malicious_comment = '<!-- This is a test comment -->';
echo "清理内部注释分隔符示例：\n";
show_html_comment_cleaned($malicious_comment);
// 输出：<!-- This is a test comment -->

echo "\n";

$simple_text = 'Just some text';
echo "清理内部注释分隔符示例 (简单文本)：\n";
show_html_comment_cleaned($simple_text);
// 输出：<!-- Just some text -->

echo "\n";

$nested_content = 'This content contains <!-- potentially problematic --> HTML. --> More text.';
echo "清理内部注释分隔符示例 (嵌套内容)：\n";
show_html_comment_cleaned($nested_content);
// 输出：<!-- This content contains  potentially problematic  HTML.  More text. -->
?>

<?php
function show_html_comment_encoded($comment)
{
    // 对内容进行HTML实体编码
    echo '<!-- ' . htmlspecialchars($comment, ENT_QUOTES | ENT_HTML5, 'UTF-8') . ' -->';
}

// 示例用法
$malicious_comment = '<!-- This is a test comment -->';
echo "HTML实体编码示例：\n";
show_html_comment_encoded($malicious_comment);
// 输出：<!-- <!-- This is a test comment --> -->

echo "\n";

$simple_text = 'Just some text';
echo "HTML实体编码示例 (简单文本)：\n";
show_html_comment_encoded($simple_text);
// 输出：<!-- Just some text -->

echo "\n";

$html_content = '<p>This is a paragraph.</p>';
echo "HTML实体编码示例 (包含HTML标签的内容)：\n";
show_html_comment_encoded($html_content);
// 输出：<!-- <p>This is a paragraph.</p> -->
?>

<?php
/**
 * 安全地将内容显示为HTML注释。
 * 优先使用htmlspecialchars进行编码，以确保最高安全性。
 *
 * @param string $comment 要显示在HTML注释中的内容。
 * @return void
 */
function safe_show_html_comment($comment)
{
    // 对内容进行HTML实体编码，防止任何HTML解析和注入
    echo '<!-- ' . htmlspecialchars($comment, ENT_QUOTES | ENT_HTML5, 'UTF-8') . ' -->';
}

// 演示
echo "<h2>安全HTML注释生成示例</h2>";

echo "<h3>使用 htmlspecialchars (推荐)</h3>";
echo "<pre>";
echo "原始内容: \$comment = '<!-- This is a test comment -->';\n";
echo "输出: ";
safe_show_html_comment('<!-- This is a test comment -->');
echo "\n";

echo "原始内容: \$comment = '<script>alert(\"XSS!\")</script>';\n";
echo "输出: ";
safe_show_html_comment('<script>alert("XSS!")</script>');
echo "\n";

echo "原始内容: \$comment = 'User input with <tag> and \"quotes\"';\n";
echo "输出: ";
safe_show_html_comment('User input with <tag> and "quotes"');
echo "</pre>";

echo "<h3>使用 str_replace (特定场景，需谨慎)</h3>";
echo "<pre>";
echo "原始内容: \$comment = '<!-- This is a test comment -->';\n";
echo "输出: ";
show_html_comment_cleaned('<!-- This is a test comment -->');
echo "\n";

echo "原始内容: \$comment = '<script>alert(\"XSS!\")</script>';\n";
echo "输出: ";
show_html_comment_cleaned('<script>alert("XSS!")</script>');
echo "  (注意：<script>标签仍保留，若注释意外结束则有风险)\n";
echo "</pre>";
?>