library/htmlspecialchars.inc.php

   1 <?php
   2 /**
   3  * library/htmlspecialchars.inc.php Escaping Functions
   4  *
   5  * Copyright © 2011 Boyd Stephen Smith Jr.
   6  * Copyright license terms appear at the end of this file.
   7  *
   8  * @package OpenEMR
   9  * @author Boyd Stephen Smith Jr.
  10  */
  11
  12 /**
  13  * Escape a PHP string for use as (part of) an HTML / XML text node.
  14  *
  15  * It only escapes a few special chars: the ampersand (&) and both the left-
  16  * pointing angle bracket (<) and the right-pointing angle bracket (>), since
  17  * these are the only characters that are special in a text node.  Minimal
  18  * quoting is preferred because it produces smaller and more easily human-
  19  * readable output.
  20  *
  21  * Some characters simply cannot appear in valid XML documents, even
  22  * as entities but, this function does not attempt to handle them.
  23  *
  24  * NOTE: Attribute values are NOT text nodes, and require additional escaping.
  25  *
  26  * @param string The string to escape, possibly including "&", "<", or ">".
  27  * @return string The string, with "&", "<", and ">" escaped.
  28  */
  29 function text($text) {
  30         return htmlspecialchars($text, ENT_NOQUOTES);
  31 }
  32
  33 /*
  34 This function uses htmlspecialchars() to escape a PHP string for use as
  35 part of an HTML / XML attribute value.  It does not surround the string in
  36 single- or double-quote characters as is required for XML.
  37
  38 This does the maximal quoting handled by htmlspecialchars()
  39
  40 Some characters simply cannot appear in valid XML documents, even
  41 as entities but, this function does not attempt to handle them.
  42
  43 NOTE: This can be used as a "generic" HTML escape since it does maximal
  44 quoting.  However, some HTML and XML contexts (CDATA) don't provide escape
  45 mechanisms.  Also, further pre- or post-escaping might need to be done when
  46 embdedded other languages (like JavaScript) inside HTML / XML documents.
  47 */
  48 function attr($text) {
  49         return htmlspecialchars($text, ENT_QUOTES);
  50 }
  51
  52 /*
  53 This function is a compatibility replacement for the out function removed from
  54 the CDR Admin framework.
  55 */
  56 function out($text) {
  57         return attr($text);
  58 }
  59
  60 /*
  61 Don't call this function.  You don't see this function.  This function doesn't
  62 exist.
  63
  64 TODO: Hide this function so it can be called from this file but not from PHP
  65 that includes / requires this file.  Either that, or write reasonable
  66 documentation and clean up the name.
  67 */
  68 function hsc_private_xl_or_warn($key) {
  69         if (function_exists('xl')) {
  70                 return xl($key);
  71         } else {
  72                 trigger_error(
  73                         'Translation via xl() was requested, but the xl()'
  74                         . ' function is not defined, yet.',
  75                         E_USER_WARNING
  76                 );
  77                 return $key;
  78         }
  79 }
  80
  81 /*
  82 Translate via xl() and then escape via text().
  83 */
  84 function xlt($key) {
  85         return text(hsc_private_xl_or_warn($key));
  86 }
  87
  88 /*
  89 Translate via xl() and then escape via attr().
  90 */
  91 function xla($key) {
  92         return attr(hsc_private_xl_or_warn($key));
  93 }
  94
  95 /*
  96 Translate via xl() and then escape via addslashes for use with javascript literals
  97 */
  98 function xls($key){
  99         return addslashes(hsc_private_xl_or_warn($key));
 100 }
 101 return; // Stop include / require from going any further (non-PHP)
 102 ?>
 103 This file is free software: you can redistribute it and/or modify
 104 it under the terms of the GNU General Public License as published by
 105 the Free Software Foundation, either version 3 of the License, or
 106 (at your option) any later version.
 107
 108 This file is distributed in the hope that it will be useful,
 109 but WITHOUT ANY WARRANTY; without even the implied warranty of
 110 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 111 GNU General Public License for more details.
 112
 113 You should have received a copy of the GNU General Public License
 114 along with this program.  If not, see <http://www.gnu.org/licenses/>.