Subversion-Projekte lars-tiefland.laravel_shop

Revision

Revision 148 | Details | Vergleich mit vorheriger | Letzte Änderung | Log anzeigen | RSS feed

Revision Autor Zeilennr. Zeile
148 lars 1 
<?php
2 
/**
3 
 * Smarty plugin
4 
 *
5 
 * @package    Smarty
6 
 * @subpackage PluginsModifier
7 
 */
8 
/**
9 
 * Smarty escape modifier plugin
10 
 * Type:     modifier
11 
 * Name:     escape
12 
 * Purpose:  escape string for output
13 
 *
14 
 * @link   https://www.smarty.net/docs/en/language.modifier.escape
15 
 * @author Monte Ohrt <monte at ohrt dot com>
16 
 *
17 
 * @param string  $string        input string
18 
 * @param string  $esc_type      escape type
19 
 * @param string  $char_set      character set, used for htmlspecialchars() or htmlentities()
20 
 * @param boolean $double_encode encode already encoded entitites again, used for htmlspecialchars() or htmlentities()
21 
 *
22 
 * @return string escaped input string
23 
 */
24 
function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $double_encode = true)
25 
{
26 
    static $is_loaded_1 = false;
27 
    static $is_loaded_2 = false;
28 
    if (!$char_set) {
29 
        $char_set = Smarty::$_CHARSET;
30 
    }
31 
 
32 
    $string = (string)$string;
33 
 
34 
    switch ($esc_type) {
35 
        case 'html':
36 
            return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode);
37 
        // no break
38 
        case 'htmlall':
39 
            if (Smarty::$_MBSTRING) {
40 
                $string = mb_convert_encoding($string, 'UTF-8', $char_set);
41 
                return htmlentities($string, ENT_QUOTES, 'UTF-8', $double_encode);
42 
            }
43 
            // no MBString fallback
44 
            return htmlentities($string, ENT_QUOTES, $char_set, $double_encode);
45 
        // no break
46 
        case 'url':
47 
            return rawurlencode($string);
48 
        case 'urlpathinfo':
49 
            return str_replace('%2F', '/', rawurlencode($string));
50 
        case 'quotes':
51 
            // escape unescaped single quotes
52 
            return preg_replace("%(?<!\\\\)'%", "\\'", $string);
53 
        case 'hex':
54 
            // escape every byte into hex
55 
            // Note that the UTF-8 encoded character ä will be represented as %c3%a4
56 
            $return = '';
57 
            $_length = strlen($string);
58 
            for ($x = 0; $x < $_length; $x++) {
59 
                $return .= '%' . bin2hex($string[ $x ]);
60 
            }
61 
            return $return;
62 
        case 'hexentity':
63 
            $return = '';
64 
            if (Smarty::$_MBSTRING) {
65 
                if (!$is_loaded_1) {
66 
                    if (!is_callable('smarty_mb_to_unicode')) {
67 
                        include_once SMARTY_PLUGINS_DIR . 'shared.mb_unicode.php';
68 
                    }
69 
                    $is_loaded_1 = true;
70 
                }
71 
                $return = '';
72 
                foreach (smarty_mb_to_unicode($string, Smarty::$_CHARSET) as $unicode) {
73 
                    $return .= '&#x' . strtoupper(dechex($unicode)) . ';';
74 
                }
75 
                return $return;
76 
            }
77 
            // no MBString fallback
78 
            $_length = strlen($string);
79 
            for ($x = 0; $x < $_length; $x++) {
80 
                $return .= '&#x' . bin2hex($string[ $x ]) . ';';
81 
            }
82 
            return $return;
83 
        case 'decentity':
84 
            $return = '';
85 
            if (Smarty::$_MBSTRING) {
86 
                if (!$is_loaded_1) {
87 
                    if (!is_callable('smarty_mb_to_unicode')) {
88 
                        include_once SMARTY_PLUGINS_DIR . 'shared.mb_unicode.php';
89 
                    }
90 
                    $is_loaded_1 = true;
91 
                }
92 
                $return = '';
93 
                foreach (smarty_mb_to_unicode($string, Smarty::$_CHARSET) as $unicode) {
94 
                    $return .= '&#' . $unicode . ';';
95 
                }
96 
                return $return;
97 
            }
98 
            // no MBString fallback
99 
            $_length = strlen($string);
100 
            for ($x = 0; $x < $_length; $x++) {
101 
                $return .= '&#' . ord($string[ $x ]) . ';';
102 
            }
103 
            return $return;
104 
        case 'javascript':
105 
            // escape quotes and backslashes, newlines, etc.
106 
            return strtr(
107 
                $string,
108 
                array(
109 
                    '\\' => '\\\\',
110 
                    "'"  => "\\'",
111 
                    '"'  => '\\"',
112 
                    "\r" => '\\r',
113 
                    "\n" => '\\n',
114 
                    '</' => '<\/',
115 
                    // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
116 
                    '<!--' => '<\!--',
117 
                    '<s'   => '<\s',
991 lars 118 
                    '<S'   => '<\S',
119 
	                "`" => "\\\\`",
120 
	                "\${" => "\\\\\\$\\{"
148 lars 121 
                )
122 
            );
123 
        case 'mail':
124 
            if (Smarty::$_MBSTRING) {
125 
                if (!$is_loaded_2) {
126 
                    if (!is_callable('smarty_mb_str_replace')) {
127 
                        include_once SMARTY_PLUGINS_DIR . 'shared.mb_str_replace.php';
128 
                    }
129 
                    $is_loaded_2 = true;
130 
                }
131 
                return smarty_mb_str_replace(
132 
                    array(
133 
                        '@',
134 
                        '.'
135 
                    ),
136 
                    array(
137 
                        ' [AT] ',
138 
                        ' [DOT] '
139 
                    ),
140 
                    $string
141 
                );
142 
            }
143 
            // no MBString fallback
144 
            return str_replace(
145 
                array(
146 
                    '@',
147 
                    '.'
148 
                ),
149 
                array(
150 
                    ' [AT] ',
151 
                    ' [DOT] '
152 
                ),
153 
                $string
154 
            );
155 
        case 'nonstd':
156 
            // escape non-standard chars, such as ms document quotes
157 
            $return = '';
158 
            if (Smarty::$_MBSTRING) {
159 
                if (!$is_loaded_1) {
160 
                    if (!is_callable('smarty_mb_to_unicode')) {
161 
                        include_once SMARTY_PLUGINS_DIR . 'shared.mb_unicode.php';
162 
                    }
163 
                    $is_loaded_1 = true;
164 
                }
165 
                foreach (smarty_mb_to_unicode($string, Smarty::$_CHARSET) as $unicode) {
166 
                    if ($unicode >= 126) {
167 
                        $return .= '&#' . $unicode . ';';
168 
                    } else {
169 
                        $return .= chr($unicode);
170 
                    }
171 
                }
172 
                return $return;
173 
            }
174 
            $_length = strlen($string);
175 
            for ($_i = 0; $_i < $_length; $_i++) {
176 
                $_ord = ord(substr($string, $_i, 1));
177 
                // non-standard char, escape it
178 
                if ($_ord >= 126) {
179 
                    $return .= '&#' . $_ord . ';';
180 
                } else {
181 
                    $return .= substr($string, $_i, 1);
182 
                }
183 
            }
184 
            return $return;
185 
        default:
186 
            trigger_error("escape: unsupported type: $esc_type - returning unmodified string", E_USER_NOTICE);
187 
            return $string;
188 
    }
189 
}