src/mako/view/renderers/traits/EscaperTrait.php
protected function attributeEscaper(array $matches): string
	{
		$chr = $matches[0];

		$ord = ord($chr);

		// The following replaces characters undefined in HTML with the
		// hex entity for the Unicode replacement character.

		if(($ord <= 0x1f && $chr !== "\t" && $chr !== "\n" && $chr !== "\r") || ($ord >= 0x7f && $ord <= 0x9f))
		{
			return '&#xFFFD;';
		}

		// Check if the current character to escape has a name entity we should
		// replace it with while grabbing the integer value of the character.

		if(strlen($chr) > 1)
		{
			$chr = mb_convert_encoding($chr, 'UTF-16BE', 'UTF-8');
		}

		$hex = bin2hex($chr);

		$ord = hexdec($hex);

		if(isset($this->htmlNamedEntityMap[$ord]))
		{
			return '&' . $this->htmlNamedEntityMap[$ord] . ';';
		}

		// Per OWASP recommendations, we'll use upper hex entities
		// for any other characters where a named entity does not exist.

		if($ord > 255)
		{
			return sprintf('&#x%04X;', $ord);
		}

		return sprintf('&#x%02X;', $ord);
	}
protected function attributeEscaper(array $matches): string
	{
		$chr = $matches[0];

		$ord = ord($chr);

		// The following replaces characters undefined in HTML with the
		// hex entity for the Unicode replacement character.

		if(($ord <= 0x1f && $chr !== "\t" && $chr !== "\n" && $chr !== "\r") || ($ord >= 0x7f && $ord <= 0x9f))
		{
			return '&#xFFFD;';
		}

		// Check if the current character to escape has a name entity we should
		// replace it with while grabbing the integer value of the character.

		if(strlen($chr) > 1)
		{
			$chr = mb_convert_encoding($chr, 'UTF-16BE', 'UTF-8');
		}

		$hex = bin2hex($chr);

		$ord = hexdec($hex);

		if(isset($this->htmlNamedEntityMap[$ord]))
		{
			return '&' . $this->htmlNamedEntityMap[$ord] . ';';
		}

		// Per OWASP recommendations, we'll use upper hex entities
		// for any other characters where a named entity does not exist.

		if($ord > 255)
		{
			return sprintf('&#x%04X;', $ord);
		}

		return sprintf('&#x%02X;', $ord);
	}
protected function attributeEscaper ( array $ matches ) : string { $ chr = $ matches [ 0 ] ; $ ord = ord ( $ chr ) ; // The following replaces characters undefined in HTML with the // hex entity for the Unicode replacement character. if ( ( $ ord <= 0x1f && $ chr !== "\t" && $ chr !== "\n" && $ chr !== "\r" ) || ( $ ord >= 0x7f && $ ord <= 0x9f ) ) { return '&#xFFFD;' ; } // Check if the current character to escape has a name entity we should // replace it with while grabbing the integer value of the character. if ( strlen ( $ chr ) > 1 ) { $ chr = mb_convert_encoding ( $ chr , 'UTF-16BE' , 'UTF-8' ) ; } $ hex = bin2hex ( $ chr ) ; $ ord = hexdec ( $ hex ) ; if ( isset ( $ this -> htmlNamedEntityMap [ $ ord ] ) ) { return '&' . $ this -> htmlNamedEntityMap [ $ ord ] . ';' ; } // Per OWASP recommendations, we'll use upper hex entities // for any other characters where a named entity does not exist. if ( $ ord > 255 ) { return sprintf ( '&#x%04X;' , $ ord ) ; } return sprintf ( '&#x%02X;' , $ ord ) ; }
Escapes characters for use in a HTML attribute context.

(This method contains code from the SecurityMultiTool library).

@param  array  $matches Regex matches
@return string
Escapes characters for use in a HTML attribute context .