Ticket #574: modifier.escape.patch

build/manifests/jelix-lib.mn

@@ -510 +510 @@
-  modifier.truncate.php
-  modifier.wiki.php
-  modifier.wordwrap.php
+  modifier.escape.php
-
-cd lib/jelix/plugins/tpl/html
-  function.jlocale.php

build/manifests/jtpl-standalone.mn

@@ -29 +29 @@
-  modifier.strip.php
-  modifier.truncate.php
-  modifier.wordwrap.php
+  modifier.escape.php
-
-sd lib/jelix/plugins/tpl/html
-dd plugins/html

lib/jelix/plugins/tpl/common/modifier.escape.php

@@ +1 @@
+<?php
+/**
+ * Plugin from smarty project and adapted for jtpl
+ * @package    jelix
+ * @subpackage jtpl_plugin
+ * @author      Njaka MISAHARISON
+ * @contributor Sylvain de Vathaire
+ * @copyright 2008 Neov
+ * @link http://smarty.php.net/
+ * @link http://jelix.org/
+ * @licence    GNU Lesser General Public Licence see LICENCE file or http://www.gnu.org/licenses/lgpl.html
+ */
+
+/**
+ * Type:     modifier<br>
+ * Name:     escape<br>
+ * Purpose:  Escape the string according to escapement type
+ * @param string
+ * @param html|htmlall|url|quotes|hex|hexentity|javascript
+ * @return string
+ */
+function jtpl_modifier_common_escape($string, $esc_type = 'html')
+{
+    switch ($esc_type) {
+        case 'html':
+            return htmlspecialchars($string, ENT_QUOTES);
+
+        case 'htmlall':
+            return htmlentities($string, ENT_QUOTES);
+
+        case 'url':
+            return urlencode($string);
+
+        case 'quotes':
+            // escape unescaped single quotes
+            return preg_replace("%(?<!\\\\)'%", "\\'", $string);
+
+        case 'hex':
+            // escape every character into hex
+            $return = '';
+            for ($x=0; $x < strlen($string); $x++) {
+                $return .= '%' . bin2hex($string[$x]);
+            }
+            return $return;
+            
+        case 'hexentity':
+            $return = '';
+            for ($x=0; $x < strlen($string); $x++) {
+                $return .= '&#x' . bin2hex($string[$x]) . ';';
+            }
+            return $return;
+
+        case 'javascript':
+            // escape quotes and backslashes and newlines
+            return strtr($string, array('\\'=>'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n'));
+
+        default:
+            return $string;
+    }
+}
+
+
+?>