TemplateHelper: fix escape with broken utf-8, close #163

If the source file that triggered an exception, had an illegal
UTF-8 sequence (because, for example, it wasn't UTF-8),
when PrettyPageHandler would try to show its source on the screen,
htmlspecialchars would return an empty string, resulting in no
source on the screen.

The workaround at least shows question marks instead of the original
characters. Guessing the correct encoding and reencoding that
to UTF-8 is too much bother at this point,
and the current approach still works well enough to see
where the error is coming from.

src/Whoops/Util/TemplateHelper.php

@@ -25,7 +25,7 @@ class TemplateHelper
      */
     public function escape($raw)
     {
-        return htmlspecialchars($raw, ENT_QUOTES, "UTF-8");
+        return htmlspecialchars($raw, ENT_QUOTES | ENT_SUBSTITUTE, "UTF-8");
     }
 
     /**

tests/Whoops/Util/TemplateHelperTest.php

@@ -37,6 +37,19 @@ class TemplateHelperTest extends TestCase
         );
     }
 
+    public function testEscapeBrokenUtf8()
+    {
+        // The following includes an illegal utf-8 sequence to test.
+        // Encoded in base64 to survive possible encoding changes of this file.
+        $original = base64_decode('VGhpcyBpcyBhbiBpbGxlZ2FsIHV0Zi04IHNlcXVlbmNlOiDD');
+
+        // Test that the escaped string is kinda similar in length, not empty
+        $this->assertLessThan(
+            10,
+            abs(strlen($original) - strlen($this->helper->escape($original)))
+        );
+    }
+
     /**
      * @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
      */