extern/egroupware
1
0
Fork 1
mirror of https://github.com/EGroupware/egroupware.git synced 2024-11-08 00:54:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

doubleencoding issue and performance issue regarding the use of html::htmlspecialchars

Browse Source
This commit is contained in:
Klaus Leithoff 2010-10-20 13:16:21 +00:00
parent 261b4521c8
commit b55bb74988
1 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
phpgwapi/inc/class.html.inc.php
View File

@ -273,23 +273,22 @@ class html
/**
* escapes chars with special meaning in html as entities
*
* Allows to use and char in the html-output and prefents XSS attacks.
* Some entities are allowed and get NOT escaped:
* - &# some translations (AFAIK the arabic ones) need this
* -   < > for convinience
* Allows to use and char in the html-output and prevents XSS attacks.
* Some entities are allowed and get NOT escaped: -> prevented by 4th param = doubleencode=false
* - &# some translations (AFAIK: the arabic ones) need this;
* -   < > for convenience -> should not happen anymore, as we do not doubleencode anymore (20101020)
*
* @param string $str string to escape
* @return string
*/
static function htmlspecialchars($str)
{
// add @ by lkneschke to supress warning about unknown charset
$str = @htmlspecialchars($str,ENT_COMPAT,self::$charset);
// as EGroupware supports only utf-8 we should not need to worry about wrong charsets
return htmlspecialchars($str,ENT_COMPAT,self::$charset,false);
// we need '&#' unchanged, so we translate it back -> this is provided by 4th param = false -> do not doubleencode
//$str = str_replace(array('&#',' ','<','>'),array('&#',' ','<','>'),$str);
// we need '&#' unchanged, so we translate it back
$str = str_replace(array('&#',' ','<','>'),array('&#',' ','<','>'),$str);
return $str;
//return $str;
}
/**