SomeGuy
/
sessioncommunities.online
Archived
1
0
Fork 1
Code Issues 13 Pull Requests 3 Activity

Introduce wrapper for htmlspecialchars

Browse Source
pull/26/head
gravel 1 year ago
parent 2fa089feae
commit 742f96a958
Signed by: gravel
SSH Key Fingerprint: SHA256:p4HP49CCk4YQMkJpWJ09L8peEPQWjERtdCRAFxPfbOY
2 changed files with 22 additions and 10 deletions
Show Stats Download Patch File Download Diff File

12
php/utils/utils.php
Unescape Escape View File

@ -148,4 +148,16 @@
return $links;
}
/**
* Convert special characters to html entities.
*/
function html_sanitize(
string $str, int $flags = ENT_QUOTES|ENT_SUBSTITUTE,
?string $encoding = null, bool $double_encode = true
) {
if ($str == "") {
return "";
}
return htmlspecialchars($str, $flags, $encoding, $double_encode);
}
?>

20
sites/+components/tbl_communities.php
Unescape Escape View File

@ -53,16 +53,16 @@
// Escape external input.
// Ternaries prevent passing null-equal strings, which produce warnings.
$id = htmlspecialchars($room->get_room_identifier());
$language = $room->language_flag ? htmlspecialchars($room->language_flag) : "";
$name = htmlspecialchars($room->name);
$desc = $room->description ? htmlspecialchars($room->description) : "";
$users = htmlspecialchars($room->active_users);
$preview_link = htmlspecialchars($room->get_preview_url());
$join_link = htmlspecialchars($room->get_join_url());
// TODO: Do not forget to rename this escape when merging!
$token = htmlspecialchars($token);
$hostname = htmlspecialchars($hostname);
$id = html_sanitize($room->get_room_identifier());
$language = html_sanitize($room->language_flag);
$name = html_sanitize($room->name);
$desc = html_sanitize($room->description);
$users = html_sanitize($room->active_users);
$preview_link = html_sanitize($room->get_preview_url());
$join_link = html_sanitize($room->get_join_url());
// TODO: Do not forget to rename this escape when mergig!
$token = html_sanitize($token);
$hostname = html_sanitize($hostname);
?>
<tr id="<?=$id?>" itemscope itemtype="https://schema.org/EntryPoint" --data-identifier="<?=$id?>">