* * @param string $string input string * @param string $esc_type escape type * @param string $char_set character set, used for htmlspecialchars() or htmlentities() * @param boolean $double_encode encode already encoded entitites again, used for htmlspecialchars() or htmlentities() * * @return string escaped input string */ function smarty_modifier_escape($string, $esc_type = 'html', $char_set = null, $double_encode = true) { static $_double_encode = true; static $is_loaded_1 = false; static $is_loaded_2 = false; if (!$char_set) { $char_set = Smarty::$_CHARSET; } $string = (string)$string; switch ($esc_type) { case 'html': if ($_double_encode) { // php >=5.3.2 - go native return htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); } else { if ($double_encode) { // php <5.2.3 - only handle double encoding return htmlspecialchars($string, ENT_QUOTES, $char_set); } else { // php <5.2.3 - prevent double encoding $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string); $string = htmlspecialchars($string, ENT_QUOTES, $char_set); $string = str_replace( array( '%%%SMARTY_START%%%', '%%%SMARTY_END%%%' ), array( '&', ';' ), $string ); return $string; } } // no break case 'htmlall': if (Smarty::$_MBSTRING) { // mb_convert_encoding ignores htmlspecialchars() if ($_double_encode) { // php >=5.3.2 - go native $string = htmlspecialchars($string, ENT_QUOTES, $char_set, $double_encode); } else { if ($double_encode) { // php <5.2.3 - only handle double encoding $string = htmlspecialchars($string, ENT_QUOTES, $char_set); } else { // php <5.2.3 - prevent double encoding $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string); $string = htmlspecialchars($string, ENT_QUOTES, $char_set); $string = str_replace( array( '%%%SMARTY_START%%%', '%%%SMARTY_END%%%' ), array( '&', ';' ), $string ); return $string; } } // htmlentities() won't convert everything, so use mb_convert_encoding return mb_convert_encoding($string, 'HTML-ENTITIES', $char_set); } // no MBString fallback if ($_double_encode) { return htmlentities($string, ENT_QUOTES, $char_set, $double_encode); } else { if ($double_encode) { return htmlentities($string, ENT_QUOTES, $char_set); } else { $string = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $string); $string = htmlentities($string, ENT_QUOTES, $char_set); $string = str_replace( array( '%%%SMARTY_START%%%', '%%%SMARTY_END%%%' ), array( '&', ';' ), $string ); return $string; } } // no break case 'url': return rawurlencode($string); case 'urlpathinfo': return str_replace('%2F', '/', rawurlencode($string)); case 'quotes': // escape unescaped single quotes return preg_replace("%(? '\\\\', "'" => "\\'", '"' => '\\"', "\r" => '\\r', "\n" => '\\n', ' '<\/', // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements '