phpmyadmin/libraries/js_escape.lib.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Javascript escaping functions.
   5  *
   6  * @package PhpMyAdmin
   7  *
   8  */
   9 if (! defined('PHPMYADMIN')) {
  10     exit;
  11 }
  12
  13 /**
  14  * Format a string so it can be a string inside JavaScript code inside an
  15  * eventhandler (onclick, onchange, on..., ).
  16  * This function is used to displays a javascript confirmation box for
  17  * "DROP/DELETE/ALTER" queries.
  18  *
  19  * @param string  $a_string       the string to format
  20  * @param boolean $add_backquotes whether to add backquotes to the string or not
  21  *
  22  * @return string   the formatted string
  23  *
  24  * @access  public
  25  */
  26 function PMA_jsFormat($a_string = '', $add_backquotes = true)
  27 {
  28     if (is_string($a_string)) {
  29         $a_string = htmlspecialchars($a_string);
  30         $a_string = PMA_escapeJsString($a_string);
  31         // Needed for inline javascript to prevent some browsers
  32         // treating it as a anchor
  33         $a_string = str_replace('#', '\\#', $a_string);
  34     }
  35
  36     return (($add_backquotes) ? PMA_Util::backquote($a_string) : $a_string);
  37 } // end of the 'PMA_jsFormat()' function
  38
  39 /**
  40  * escapes a string to be inserted as string a JavaScript block
  41  * enclosed by <![CDATA[ ... ]]>
  42  * this requires only to escape ' with \' and end of script block
  43  *
  44  * We also remove NUL byte as some browsers (namely MSIE) ignore it and
  45  * inserting it anywhere inside </script would allow to bypass this check.
  46  *
  47  * @param string $string the string to be escaped
  48  *
  49  * @return string  the escaped string
  50  */
  51 function PMA_escapeJsString($string)
  52 {
  53     return preg_replace(
  54         '@</script@i', '</\' + \'script',
  55         strtr(
  56             $string,
  57             array(
  58                 "\000" => '',
  59                 '\\' => '\\\\',
  60                 '\'' => '\\\'',
  61                 '"' => '\"',
  62                 "\n" => '\n',
  63                 "\r" => '\r'
  64             )
  65         )
  66     );
  67 }
  68
  69 /**
  70  * Formats a value for javascript code.
  71  *
  72  * @param string $value String to be formatted.
  73  *
  74  * @return string formatted value.
  75  */
  76 function PMA_formatJsVal($value)
  77 {
  78     if (is_bool($value)) {
  79         if ($value) {
  80             return 'true';
  81         }
  82
  83         return 'false';
  84     }
  85
  86     if (is_int($value)) {
  87         return (int)$value;
  88     }
  89
  90     return '"' . PMA_escapeJsString($value) . '"';
  91 }
  92
  93 /**
  94  * Formats an javascript assignment with proper escaping of a value
  95  * and support for assigning array of strings.
  96  *
  97  * @param string $key    Name of value to set
  98  * @param mixed  $value  Value to set, can be either string or array of strings
  99  * @param bool   $escape Whether to escape value or keep it as it is
 100  *                       (for inclusion of js code)
 101  *
 102  * @return string Javascript code.
 103  */
 104 function PMA_getJsValue($key, $value, $escape = true)
 105 {
 106     $result = $key . ' = ';
 107     if (!$escape) {
 108         $result .= $value;
 109     } elseif (is_array($value)) {
 110         $result .= '[';
 111         foreach ($value as $val) {
 112             $result .= PMA_formatJsVal($val) . ",";
 113         }
 114         $result .= "];\n";
 115     } else {
 116         $result .= PMA_formatJsVal($value) . ";\n";
 117     }
 118     return $result;
 119 }
 120
 121 /**
 122  * Prints an javascript assignment with proper escaping of a value
 123  * and support for assigning array of strings.
 124  *
 125  * @param string $key   Name of value to set
 126  * @param mixed  $value Value to set, can be either string or array of strings
 127  *
 128  * @return void
 129  */
 130 function PMA_printJsValue($key, $value)
 131 {
 132     echo PMA_getJsValue($key, $value);
 133 }
 134
 135 ?>