library/htmlspecialchars.inc.php

   1 <?php
   2
   3 /**
   4  * Escaping Functions
   5  *
   6  * @package   OpenEMR
   7  * @link      https://www.open-emr.org
   8  * @author    Boyd Stephen Smith Jr.
   9  * @author    Brady Miller <brady.g.miller@gmail.com>
  10  * @copyright Copyright (c) 2011 Boyd Stephen Smith Jr.
  11  * @copyright Copyright (c) 2018 Brady Miller <brady.g.miller@gmail.com>
  12  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  13  */
  14
  15 /**
  16  * Escape a javascript literal.
  17  */
  18 function js_escape($text)
  19 {
  20     return json_encode($text);
  21 }
  22
  23 /**
  24  * Escape a javascript literal within html onclick attribute.
  25  */
  26 function attr_js($text)
  27 {
  28     return attr(json_encode($text));
  29 }
  30
  31 /**
  32  * Escape html and url encode a url item.
  33  */
  34 function attr_url($text)
  35 {
  36     return attr(urlencode($text));
  37 }
  38
  39 /**
  40  * Escape js and url encode a url item.
  41  */
  42 function js_url($text)
  43 {
  44     return js_escape(urlencode($text));
  45 }
  46
  47 /**
  48  * Escape variables that are outputted into the php error log.
  49  */
  50 function errorLogEscape($text)
  51 {
  52     return attr($text);
  53 }
  54
  55 /**
  56  * Escape variables that are outputted into csv and spreadsheet files.
  57  * See here: https://www.owasp.org/index.php/CSV_Injection
  58  * Based mitigation strategy on this report: https://asecurityz.blogspot.com/2017/12/csv-injection-mitigations.html
  59  *  1. Remove all the following characters:  = + " |
  60  *  2. Only remove leading - characters (since need in dates)
  61  *  3. Only remove leading @ characters (since need in email addresses)
  62  *  4. Surround with double quotes (no reference link, but seems very reasonable, which will prevent commas from breaking things).
  63  * If needed in future, will add a second parameter called 'options' which will be an array of option tokens that will allow
  64  * less stringent (or more stringent) mechanisms to escape for csv.
  65  */
  66 function csvEscape($text)
  67 {
  68     // 1. Remove all the following characters:  = + " |
  69     $text = preg_replace('/[=+"|]/', '', $text);
  70
  71     // 2. Only remove leading - characters (since need in dates)
  72     // 3. Only remove leading @ characters (since need in email addresses)
  73     $text = preg_replace('/^[\-@]+/', '', $text);
  74
  75     // 4. Surround with double quotes (no reference link, but seems very reasonable, which will prevent commas from breaking things).
  76     return '"' . $text . '"';
  77 }
  78
  79 /**
  80  * Escape a PHP string for use as (part of) an HTML / XML text node.
  81  *
  82  * It only escapes a few special chars: the ampersand (&) and both the left-
  83  * pointing angle bracket (<) and the right-pointing angle bracket (>), since
  84  * these are the only characters that are special in a text node.  Minimal
  85  * quoting is preferred because it produces smaller and more easily human-
  86  * readable output.
  87  *
  88  * Some characters simply cannot appear in valid XML documents, even
  89  * as entities but, this function does not attempt to handle them.
  90  *
  91  * NOTE: Attribute values are NOT text nodes, and require additional escaping.
  92  *
  93  * @param string $text The string to escape, possibly including "&", "<",
  94  *                     or ">".
  95  * @return string The string, with "&", "<", and ">" escaped.
  96  */
  97 function text($text)
  98 {
  99     return htmlspecialchars($text, ENT_NOQUOTES);
 100 }
 101
 102 /**
 103  * Escape a PHP string for use as (part of) an HTML / XML attribute value.
 104  *
 105  * It escapes several special chars: the ampersand (&), the double quote
 106  * ("), the singlequote ('), and both the left-pointing angle bracket (<)
 107  * and the right-pointing angle bracket (>), since these are the characters
 108  * that are special in an attribute value.
 109  *
 110  * Some characters simply cannot appear in valid XML documents, even
 111  * as entities but, this function does not attempt to handle them.
 112  *
 113  * NOTE: This can be used as a "generic" HTML escape since it does maximal
 114  * quoting.  However, some HTML and XML contexts (CDATA) don't provide
 115  * escape mechanisms.  Also, further pre- or post-escaping might need to
 116  * be done when embdedded other languages (like JavaScript) inside HTML /
 117  * XML documents.
 118  *
 119  * @param string $text The string to escape, possibly including (&), (<),
 120  *                     (>), ('), and (").
 121  * @return string The string, with (&), (<), (>), ("), and (') escaped.
 122  */
 123 function attr($text)
 124 {
 125     return htmlspecialchars($text, ENT_QUOTES);
 126 }
 127
 128 /**
 129  * Don't call this function.  You don't see this function.  This function
 130  * doesn't exist.
 131  *
 132  * TODO: Hide this function so it can be called from this file but not from
 133  * PHP that includes / requires this file.  Either that, or write reasonable
 134  * documentation and clean up the name.
 135  */
 136 function hsc_private_xl_or_warn($key)
 137 {
 138     if (function_exists('xl')) {
 139         return xl($key);
 140     } else {
 141         trigger_error(
 142             'Translation via xl() was requested, but the xl()'
 143             . ' function is not defined, yet.',
 144             E_USER_WARNING
 145         );
 146         return $key;
 147     }
 148 }
 149
 150 /**
 151  * Translate via xl() and then escape via text().
 152  *
 153  * @param string $key The string to escape, possibly including "&", "<",
 154  *                    or ">".
 155  * @return string The string, with "&", "<", and ">" escaped.
 156  */
 157 function xlt($key)
 158 {
 159     return text(hsc_private_xl_or_warn($key));
 160 }
 161
 162 /**
 163  * Translate via xl() and then escape via attr().
 164  *
 165  * @param string $key The string to escape, possibly including (&), (<),
 166  *                    (>), ('), and (").
 167  * @return string The string, with (&), (<), (>), ("), and (') escaped.
 168  */
 169 function xla($key)
 170 {
 171     return attr(hsc_private_xl_or_warn($key));
 172 }
 173
 174 /*
 175  * Translate via xl() and then escape via js_escape for use with javascript literals
 176  */
 177 function xlj($key)
 178 {
 179     return js_escape(hsc_private_xl_or_warn($key));
 180 }
 181
 182 /*
 183  * Deprecated
 184  *Translate via xl() and then escape via addslashes for use with javascript literals
 185  */
 186 function xls($key)
 187 {
 188     return addslashes(hsc_private_xl_or_warn($key));
 189 }