Today, one of my customers notified my of a problem with a website I have created for him. The site uses an Adobe Flash movie to collect data from the visitor and then sends the data (including some raw image data) to a PHP script for further processing.

After updating the Adobe Flash Player installation to 10.1, the PHP script would (in some situations) terminate with the error “Call to a member function asXML() on a non-object”. The problem here is that the script uses the PHP parser function “simplexml_load_string” to parse an XML document sent from the Flash movie and then works with the XML DOM object returned by the function. When the string given to “simplexml_load_string” is not a valid XML document, the function will return NULL and this is what happened.

So I had to investigate why the Flash movie would suddenly send non-valid XML when it didn’t all the time before. Upon examination I found that the XML code sent by the Flash movie contained   entities as they are used in HTML. XML however (while it does know the concept of entities) does by default not know these entities but only a very limited set of entities, so an XML document containing the   entity will not be accepted as valid XML.

Comparing the behaviour with an older version of Adobe Flash Player (10.0) I found that this is obviously a bug introduced in version 10.1. The problem can be reproduced in a minimal flash movie using the following Action Script code:

 var xml:XML = new XML();
 var SubNode:XMLNode = new XMLNode(1, "TestNode");
 //Nonbreakable space
 SubNode.attributes.TestAttribte = "\xA0";
 xml.appendChild(SubNode);
 xml.send("Test.php", "_self", "POST");

Using the Live HTTP Headers extension of Firefox the problem can be made visible.

This is what it looks like with the older version 10,0,45,2 of Flash Player:

The newest version 10,1,53,64 incorrectly replaces the nonbreakable space character with the HTML entity:

I have reported this bug to Adobe and it will be interesting to see how quick it will be fixed.

Inside my PHP script, I currently use the following function to replace the incorrectly set   entity before processing by Simple XML:

function fixAdobeNBSPBug($s){
  $code = chr(0xC2) + chr(0xA0);
  $s = str_replace(' ', $code, $s);
  return $s;
}