diff options
Diffstat (limited to 'libs/plugins/modifier.escape.php')
| -rw-r--r-- | libs/plugins/modifier.escape.php | 124 |
1 files changed, 88 insertions, 36 deletions
diff --git a/libs/plugins/modifier.escape.php b/libs/plugins/modifier.escape.php index 37bc0e30..5e865a8f 100644 --- a/libs/plugins/modifier.escape.php +++ b/libs/plugins/modifier.escape.php @@ -1,33 +1,46 @@ <?php /** * Smarty plugin - * + * * @package Smarty * @subpackage PluginsModifier */ - + /** * Smarty escape modifier plugin - * + * * Type: modifier<br> * Name: escape<br> * Purpose: escape string for output - * - * @link http://smarty.php.net/manual/en/language.modifier.count.characters.php count_characters (Smarty online manual) - * @author Monte Ohrt <monte at ohrt dot com> - * @param string $string input string - * @param string $esc_type escape type - * @param string $char_set character set + * + * @link http://www.smarty.net/manual/en/language.modifier.count.characters.php count_characters (Smarty online manual) + * @author Monte Ohrt <monte at ohrt dot com> + * @param string $string input string + * @param string $esc_type escape type + * @param string $char_set character set, used for htmlspecialchars() or htmlentities() + * @param boolean $double_encode encode already encoded entitites again, used for htmlspecialchars() or htmlentities() * @return string escaped input string */ -function smarty_modifier_escape($string, $esc_type = 'html', $char_set = SMARTY_RESOURCE_CHAR_SET) +function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $double_encode = true) { + if (!$char_set) { + $char_set = SMARTY_RESOURCE_CHAR_SET; + } + switch ($esc_type) { case 'html': - return htmlspecialchars($string, ENT_QUOTES, $char_set); + return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); case 'htmlall': - return htmlentities($string, ENT_QUOTES, $char_set); + if (SMARTY_MBSTRING /* ^phpunit */ && empty($_SERVER['SMARTY_PHPUNIT_DISABLE_MBSTRING'])/* phpunit$ */) { + // mb_convert_encoding ignores htmlspecialchars() + $string = htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); + // htmlentities() won't convert everything, so use mb_convert_encoding + return mb_convert_encoding($string, 'HTML-ENTITIES', $char_set); + } + + // no MBString fallback + return htmlentities($string, ENT_QUOTES, $char_set, $double_encode); case 'url': return rawurlencode($string); @@ -35,57 +48,96 @@ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = SMARTY_ case 'urlpathinfo': return str_replace('%2F', '/', rawurlencode($string)); - case 'quotes': + case 'quotes': // escape unescaped single quotes return preg_replace("%(?<!\\\\)'%", "\\'", $string); - case 'hex': - // escape every character into hex + case 'hex': + // escape every byte into hex + // Note that the UTF-8 encoded character รค will be represented as %c3%a4 $return = ''; - for ($x = 0; $x < strlen($string); $x++) { + $_length = strlen($string); + for ($x = 0; $x < $_length; $x++) { $return .= '%' . bin2hex($string[$x]); - } + } return $return; case 'hexentity': $return = ''; - for ($x = 0; $x < strlen($string); $x++) { + if (SMARTY_MBSTRING /* ^phpunit */ && empty($_SERVER['SMARTY_PHPUNIT_DISABLE_MBSTRING'])/* phpunit$ */) { + require_once(SMARTY_PLUGINS_DIR . 'shared.mb_unicode.php'); + $return = ''; + foreach (smarty_mb_to_unicode($string, SMARTY_RESOURCE_CHAR_SET) as $unicode) { + $return .= '&#x' . strtoupper(dechex($unicode)) . ';'; + } + return $return; + } + // no MBString fallback + $_length = strlen($string); + for ($x = 0; $x < $_length; $x++) { $return .= '&#x' . bin2hex($string[$x]) . ';'; - } + } return $return; case 'decentity': $return = ''; - for ($x = 0; $x < strlen($string); $x++) { + if (SMARTY_MBSTRING /* ^phpunit */ && empty($_SERVER['SMARTY_PHPUNIT_DISABLE_MBSTRING'])/* phpunit$ */) { + require_once(SMARTY_PLUGINS_DIR . 'shared.mb_unicode.php'); + $return = ''; + foreach (smarty_mb_to_unicode($string, SMARTY_RESOURCE_CHAR_SET) as $unicode) { + $return .= '&#' . $unicode . ';'; + } + return $return; + } + // no MBString fallback + $_length = strlen($string); + for ($x = 0; $x < $_length; $x++) { $return .= '&#' . ord($string[$x]) . ';'; - } + } return $return; - case 'javascript': + case 'javascript': // escape quotes and backslashes, newlines, etc. return strtr($string, array('\\' => '\\\\', "'" => "\\'", '"' => '\\"', "\r" => '\\r', "\n" => '\\n', '</' => '<\/')); - case 'mail': - require_once(SMARTY_PLUGINS_DIR . 'shared.mb_str_replace.php'); - return smarty_mb_str_replace(array('@', '.'), array(' [AT] ', ' [DOT] '), $string); + case 'mail': + if (SMARTY_MBSTRING /* ^phpunit */ && empty($_SERVER['SMARTY_PHPUNIT_DISABLE_MBSTRING'])/* phpunit$ */) { + require_once(SMARTY_PLUGINS_DIR . 'shared.mb_str_replace.php'); + return smarty_mb_str_replace(array('@', '.'), array(' [AT] ', ' [DOT] '), $string); + } + // no MBString fallback + return str_replace(array('@', '.'), array(' [AT] ', ' [DOT] '), $string); - case 'nonstd': + case 'nonstd': // escape non-standard chars, such as ms document quotes - $_res = ''; - for($_i = 0, $_len = strlen($string); $_i < $_len; $_i++) { - $_ord = ord(substr($string, $_i, 1)); + $return = ''; + if (SMARTY_MBSTRING /* ^phpunit */ && empty($_SERVER['SMARTY_PHPUNIT_DISABLE_MBSTRING'])/* phpunit$ */) { + require_once(SMARTY_PLUGINS_DIR . 'shared.mb_unicode.php'); + foreach (smarty_mb_to_unicode($string, SMARTY_RESOURCE_CHAR_SET) as $unicode) { + if ($unicode >= 126) { + $return .= '&#' . $unicode . ';'; + } else { + $return .= chr($unicode); + } + } + return $return; + } + + $_length = strlen($string); + for ($_i = 0; $_i < $_length; $_i++) { + $_ord = ord(substr($string, $_i, 1)); // non-standard char, escape it if ($_ord >= 126) { - $_res .= '&#' . $_ord . ';'; + $return .= '&#' . $_ord . ';'; } else { - $_res .= substr($string, $_i, 1); - } - } - return $_res; + $return .= substr($string, $_i, 1); + } + } + return $return; default: return $string; - } -} + } +} ?>
\ No newline at end of file |