phpmyadmin/libraries/js_escape.lib.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Javascript escaping functions.
   5  *
   6  * @package PhpMyAdmin
   7  *
   8  */
   9 if (! defined('PHPMYADMIN')) {
  10     exit;
  11 }
  12
  13 /**
  14  * Format a string so it can be a string inside JavaScript code inside an
  15  * eventhandler (onclick, onchange, on..., ).
  16  * This function is used to displays a javascript confirmation box for
  17  * "DROP/DELETE/ALTER" queries.
  18  *
  19  * @param string  $a_string       the string to format
  20  * @param boolean $add_backquotes whether to add backquotes to the string or not
  21  *
  22  * @return string   the formatted string
  23  *
  24  * @access  public
  25  */
  26 function PMA_jsFormat($a_string = '', $add_backquotes = true)
  27 {
  28     if (is_string($a_string)) {
  29         $a_string = htmlspecialchars($a_string);
  30         $a_string = PMA_escapeJsString($a_string);
  31         // Needed for inline javascript to prevent some browsers
  32         // treating it as a anchor
  33         $a_string = str_replace('#', '\\#', $a_string);
  34     }
  35
  36     return (($add_backquotes) ? PMA_Util::backquote($a_string) : $a_string);
  37 } // end of the 'PMA_jsFormat()' function
  38
  39 /**
  40  * escapes a string to be inserted as string a JavaScript block
  41  * enclosed by <![CDATA[ ... ]]>
  42  * this requires only to escape ' with \' and end of script block
  43  *
  44  * We also remove NUL byte as some browsers (namely MSIE) ignore it and
  45  * inserting it anywhere inside </script would allow to bypass this check.
  46  *
  47  * @param string $string the string to be escaped
  48  *
  49  * @return string  the escaped string
  50  */
  51 function PMA_escapeJsString($string)
  52 {
  53     return preg_replace(
  54         '@</script@i', '</\' + \'script',
  55         strtr(
  56             $string,
  57             array(
  58                 "\000" => '',
  59                 '\\' => '\\\\',
  60                 '\'' => '\\\'',
  61                 '"' => '\"',
  62                 "\n" => '\n',
  63                 "\r" => '\r'
  64             )
  65         )
  66     );
  67 }
  68
  69 /**
  70  * Formats a value for javascript code.
  71  *
  72  * @param string $value String to be formatted.
  73  *
  74  * @return string formatted value.
  75  */
  76 function PMA_formatJsVal($value)
  77 {
  78     if (is_bool($value)) {
  79         if ($value) {
  80             return 'true';
  81         } else {
  82             return 'false';
  83         }
  84     } elseif (is_int($value)) {
  85         return (int)$value;
  86     } else {
  87         return '"' . PMA_escapeJsString($value) . '"';
  88     }
  89 }
  90
  91 /**
  92  * Formats an javascript assignment with proper escaping of a value
  93  * and support for assigning array of strings.
  94  *
  95  * @param string $key    Name of value to set
  96  * @param mixed  $value  Value to set, can be either string or array of strings
  97  * @param bool   $escape Whether to escape value or keep it as it is
  98  *                       (for inclusion of js code)
  99  *
 100  * @return string Javascript code.
 101  */
 102 function PMA_getJsValue($key, $value, $escape = true)
 103 {
 104     $result = $key . ' = ';
 105     if (!$escape) {
 106         $result .= $value;
 107     } elseif (is_array($value)) {
 108         $result .= '[';
 109         foreach ($value as $val) {
 110             $result .= PMA_formatJsVal($val) . ",";
 111         }
 112         $result .= "];\n";
 113     } else {
 114         $result .= PMA_formatJsVal($value) . ";\n";
 115     }
 116     return $result;
 117 }
 118
 119 /**
 120  * Prints an javascript assignment with proper escaping of a value
 121  * and support for assigning array of strings.
 122  *
 123  * @param string $key   Name of value to set
 124  * @param mixed  $value Value to set, can be either string or array of strings
 125  *
 126  * @return void
 127  */
 128 function PMA_printJsValue($key, $value)
 129 {
 130     echo PMA_getJsValue($key, $value);
 131 }
 132
 133 ?>