lib/api/smarty/plugins/modifier.escape.php

   1 <?php
   2 /**
   3  * Smarty plugin
   4  *
   5  * @package    Smarty
   6  * @subpackage PluginsModifier
   7  */
   8
   9 /**
  10  * Smarty escape modifier plugin
  11  * Type:     modifier<br>
  12  * Name:     escape<br>
  13  * Purpose:  escape string for output
  14  *
  15  * @link   http://www.smarty.net/docs/en/language.modifier.escape
  16  * @author Monte Ohrt <monte at ohrt dot com>
  17  *
  18  * @param string  $string        input string
  19  * @param string  $esc_type      escape type
  20  * @param string  $char_set      character set, used for htmlspecialchars() or htmlentities()
  21  * @param boolean $double_encode encode already encoded entitites again, used for htmlspecialchars() or htmlentities()
  22  *
  23  * @return string escaped input string
  24  */
  25 function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $double_encode = true)
  26 {
  27     static $_double_encode = null;
  28     if ($_double_encode === null) {
  29         $_double_encode = version_compare(PHP_VERSION, '5.2.3', '>=');
  30     }
  31
  32     if (!$char_set) {
  33         $char_set = Smarty::$_CHARSET;
  34     }
  35
  36     switch ($esc_type) {
  37         case 'html':
  38             if ($_double_encode) {
  39                 // php >=5.3.2 - go native
  40                 return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode);
  41             } else {
  42                 if ($double_encode) {
  43                     // php <5.2.3 - only handle double encoding
  44                     return htmlspecialchars($string, ENT_QUOTES, $char_set);
  45                 } else {
  46                     // php <5.2.3 - prevent double encoding
  47                     $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string);
  48                     $string = htmlspecialchars($string, ENT_QUOTES, $char_set);
  49                     $string = str_replace(array('%%%SMARTY_START%%%', '%%%SMARTY_END%%%'), array('&', ';'), $string);
  50
  51                     return $string;
  52                 }
  53             }
  54
  55         case 'htmlall':
  56             if (Smarty::$_MBSTRING) {
  57                 // mb_convert_encoding ignores htmlspecialchars()
  58                 if ($_double_encode) {
  59                     // php >=5.3.2 - go native
  60                     $string = htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode);
  61                 } else {
  62                     if ($double_encode) {
  63                         // php <5.2.3 - only handle double encoding
  64                         $string = htmlspecialchars($string, ENT_QUOTES, $char_set);
  65                     } else {
  66                         // php <5.2.3 - prevent double encoding
  67                         $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string);
  68                         $string = htmlspecialchars($string, ENT_QUOTES, $char_set);
  69                         $string = str_replace(array('%%%SMARTY_START%%%', '%%%SMARTY_END%%%'), array('&', ';'), $string);
  70
  71                         return $string;
  72                     }
  73                 }
  74
  75                 // htmlentities() won't convert everything, so use mb_convert_encoding
  76                 return mb_convert_encoding($string, 'HTML-ENTITIES', $char_set);
  77             }
  78
  79             // no MBString fallback
  80             if ($_double_encode) {
  81                 return htmlentities($string, ENT_QUOTES, $char_set, $double_encode);
  82             } else {
  83                 if ($double_encode) {
  84                     return htmlentities($string, ENT_QUOTES, $char_set);
  85                 } else {
  86                     $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string);
  87                     $string = htmlentities($string, ENT_QUOTES, $char_set);
  88                     $string = str_replace(array('%%%SMARTY_START%%%', '%%%SMARTY_END%%%'), array('&', ';'), $string);
  89
  90                     return $string;
  91                 }
  92             }
  93
  94         case 'url':
  95             return rawurlencode($string);
  96
  97         case 'urlpathinfo':
  98             return str_replace('%2F', '/', rawurlencode($string));
  99
 100         case 'quotes':
 101             // escape unescaped single quotes
 102             return preg_replace("%(?<!\\\\)'%", "\\'", $string);
 103
 104         case 'hex':
 105             // escape every byte into hex
 106             // Note that the UTF-8 encoded character ä will be represented as %c3%a4
 107             $return = '';
 108             $_length = strlen($string);
 109             for ($x = 0; $x < $_length; $x ++) {
 110                 $return .= '%' . bin2hex($string[$x]);
 111             }
 112
 113             return $return;
 114
 115         case 'hexentity':
 116             $return = '';
 117             if (Smarty::$_MBSTRING) {
 118                 require_once(SMARTY_PLUGINS_DIR . 'shared.mb_unicode.php');
 119                 $return = '';
 120                 foreach (smarty_mb_to_unicode($string, Smarty::$_CHARSET) as $unicode) {
 121                     $return .= '&#x' . strtoupper(dechex($unicode)) . ';';
 122                 }
 123
 124                 return $return;
 125             }
 126             // no MBString fallback
 127             $_length = strlen($string);
 128             for ($x = 0; $x < $_length; $x ++) {
 129                 $return .= '&#x' . bin2hex($string[$x]) . ';';
 130             }
 131
 132             return $return;
 133
 134         case 'decentity':
 135             $return = '';
 136             if (Smarty::$_MBSTRING) {
 137                 require_once(SMARTY_PLUGINS_DIR . 'shared.mb_unicode.php');
 138                 $return = '';
 139                 foreach (smarty_mb_to_unicode($string, Smarty::$_CHARSET) as $unicode) {
 140                     $return .= '&#' . $unicode . ';';
 141                 }
 142
 143                 return $return;
 144             }
 145             // no MBString fallback
 146             $_length = strlen($string);
 147             for ($x = 0; $x < $_length; $x ++) {
 148                 $return .= '&#' . ord($string[$x]) . ';';
 149             }
 150
 151             return $return;
 152
 153         case 'javascript':
 154             // escape quotes and backslashes, newlines, etc.
 155             return strtr($string, array('\\' => '\\\\', "'" => "\\'", '"' => '\\"', "\r" => '\\r', "\n" => '\\n', '</' => '<\/'));
 156
 157         case 'mail':
 158             if (Smarty::$_MBSTRING) {
 159                 require_once(SMARTY_PLUGINS_DIR . 'shared.mb_str_replace.php');
 160
 161                 return smarty_mb_str_replace(array('@', '.'), array(' [AT] ', ' [DOT] '), $string);
 162             }
 163             // no MBString fallback
 164             return str_replace(array('@', '.'), array(' [AT] ', ' [DOT] '), $string);
 165
 166         case 'nonstd':
 167             // escape non-standard chars, such as ms document quotes
 168             $return = '';
 169             if (Smarty::$_MBSTRING) {
 170                 require_once(SMARTY_PLUGINS_DIR . 'shared.mb_unicode.php');
 171                 foreach (smarty_mb_to_unicode($string, Smarty::$_CHARSET) as $unicode) {
 172                     if ($unicode >= 126) {
 173                         $return .= '&#' . $unicode . ';';
 174                     } else {
 175                         $return .= chr($unicode);
 176                     }
 177                 }
 178
 179                 return $return;
 180             }
 181
 182             $_length = strlen($string);
 183             for ($_i = 0; $_i < $_length; $_i ++) {
 184                 $_ord = ord(substr($string, $_i, 1));
 185                 // non-standard char, escape it
 186                 if ($_ord >= 126) {
 187                     $return .= '&#' . $_ord . ';';
 188                 } else {
 189                     $return .= substr($string, $_i, 1);
 190                 }
 191             }
 192
 193             return $return;
 194
 195         default:
 196             return $string;
 197     }
 198 }