roundcubemail/program/lib/Roundcube/rcube_utils.php
public static function rep_specialchars_output($str, $enctype = '', $mode = '', $newlines = true)
    {
        static $html_encode_arr = false;
        static $js_rep_table    = false;
        static $xml_rep_table   = false;

        if (!is_string($str)) {
            $str = strval($str);
        }

        // encode for HTML output
        if ($enctype == 'html') {
            if (!$html_encode_arr) {
                $html_encode_arr = get_html_translation_table(HTML_SPECIALCHARS);
                unset($html_encode_arr['?']);
            }

            $encode_arr = $html_encode_arr;

            if ($mode == 'remove') {
                $str = strip_tags($str);
            }
            else if ($mode != 'strict') {
                // don't replace quotes and html tags
                $ltpos = strpos($str, '<');
                if ($ltpos !== false && strpos($str, '>', $ltpos) !== false) {
                    unset($encode_arr['"']);
                    unset($encode_arr['<']);
                    unset($encode_arr['>']);
                    unset($encode_arr['&']);
                }
            }

            $out = strtr($str, $encode_arr);

            return $newlines ? nl2br($out) : $out;
        }

        // if the replace tables for XML and JS are not yet defined
        if ($js_rep_table === false) {
            $js_rep_table = $xml_rep_table = array();
            $xml_rep_table['&'] = '&amp;';

            // can be increased to support more charsets
            for ($c=160; $c<256; $c++) {
                $xml_rep_table[chr($c)] = "&#$c;";
            }

            $xml_rep_table['"'] = '&quot;';
            $js_rep_table['"']  = '\\"';
            $js_rep_table["'"]  = "\\'";
            $js_rep_table["\\"] = "\\\\";
            // Unicode line and paragraph separators (#1486310)
            $js_rep_table[chr(hexdec('E2')).chr(hexdec('80')).chr(hexdec('A8'))] = '&#8232;';
            $js_rep_table[chr(hexdec('E2')).chr(hexdec('80')).chr(hexdec('A9'))] = '&#8233;';
        }

        // encode for javascript use
        if ($enctype == 'js') {
            return preg_replace(array("/\r?\n/", "/\r/", '/<\\//'), array('\n', '\n', '<\\/'), strtr($str, $js_rep_table));
        }

        // encode for plaintext
        if ($enctype == 'text') {
            return str_replace("\r\n", "\n", $mode == 'remove' ? strip_tags($str) : $str);
        }

        if ($enctype == 'url') {
            return rawurlencode($str);
        }

        // encode for XML
        if ($enctype == 'xml') {
            return strtr($str, $xml_rep_table);
        }

        // no encoding given -> return original string
        return $str;
    }
public static function rep_specialchars_output($str, $enctype = '', $mode = '', $newlines = true)
    {
        static $html_encode_arr = false;
        static $js_rep_table    = false;
        static $xml_rep_table   = false;

        if (!is_string($str)) {
            $str = strval($str);
        }

        // encode for HTML output
        if ($enctype == 'html') {
            if (!$html_encode_arr) {
                $html_encode_arr = get_html_translation_table(HTML_SPECIALCHARS);
                unset($html_encode_arr['?']);
            }

            $encode_arr = $html_encode_arr;

            if ($mode == 'remove') {
                $str = strip_tags($str);
            }
            else if ($mode != 'strict') {
                // don't replace quotes and html tags
                $ltpos = strpos($str, '<');
                if ($ltpos !== false && strpos($str, '>', $ltpos) !== false) {
                    unset($encode_arr['"']);
                    unset($encode_arr['<']);
                    unset($encode_arr['>']);
                    unset($encode_arr['&']);
                }
            }

            $out = strtr($str, $encode_arr);

            return $newlines ? nl2br($out) : $out;
        }

        // if the replace tables for XML and JS are not yet defined
        if ($js_rep_table === false) {
            $js_rep_table = $xml_rep_table = array();
            $xml_rep_table['&'] = '&amp;';

            // can be increased to support more charsets
            for ($c=160; $c<256; $c++) {
                $xml_rep_table[chr($c)] = "&#$c;";
            }

            $xml_rep_table['"'] = '&quot;';
            $js_rep_table['"']  = '\\"';
            $js_rep_table["'"]  = "\\'";
            $js_rep_table["\\"] = "\\\\";
            // Unicode line and paragraph separators (#1486310)
            $js_rep_table[chr(hexdec('E2')).chr(hexdec('80')).chr(hexdec('A8'))] = '&#8232;';
            $js_rep_table[chr(hexdec('E2')).chr(hexdec('80')).chr(hexdec('A9'))] = '&#8233;';
        }

        // encode for javascript use
        if ($enctype == 'js') {
            return preg_replace(array("/\r?\n/", "/\r/", '/<\\//'), array('\n', '\n', '<\\/'), strtr($str, $js_rep_table));
        }

        // encode for plaintext
        if ($enctype == 'text') {
            return str_replace("\r\n", "\n", $mode == 'remove' ? strip_tags($str) : $str);
        }

        if ($enctype == 'url') {
            return rawurlencode($str);
        }

        // encode for XML
        if ($enctype == 'xml') {
            return strtr($str, $xml_rep_table);
        }

        // no encoding given -> return original string
        return $str;
    }
public static function rep_specialchars_output ( $ str , $ enctype = '' , $ mode = '' , $ newlines = true ) { static $ html_encode_arr = false ; static $ js_rep_table = false ; static $ xml_rep_table = false ; if ( ! is_string ( $ str ) ) { $ str = strval ( $ str ) ; } // encode for HTML output if ( $ enctype == 'html' ) { if ( ! $ html_encode_arr ) { $ html_encode_arr = get_html_translation_table ( HTML_SPECIALCHARS ) ; unset ( $ html_encode_arr [ '?' ] ) ; } $ encode_arr = $ html_encode_arr ; if ( $ mode == 'remove' ) { $ str = strip_tags ( $ str ) ; } else if ( $ mode != 'strict' ) { // don't replace quotes and html tags $ ltpos = strpos ( $ str , '<' ) ; if ( $ ltpos !== false && strpos ( $ str , '>' , $ ltpos ) !== false ) { unset ( $ encode_arr [ '"' ] ) ; unset ( $ encode_arr [ '<' ] ) ; unset ( $ encode_arr [ '>' ] ) ; unset ( $ encode_arr [ '&' ] ) ; } } $ out = strtr ( $ str , $ encode_arr ) ; return $ newlines ? nl2br ( $ out ) : $ out ; } // if the replace tables for XML and JS are not yet defined if ( $ js_rep_table === false ) { $ js_rep_table = $ xml_rep_table = array ( ) ; $ xml_rep_table [ '&' ] = '&amp;' ; // can be increased to support more charsets for ( $ c = 160 ; $ c < 256 ; $ c ++ ) { $ xml_rep_table [ chr ( $ c ) ] = "&#$c;" ; } $ xml_rep_table [ '"' ] = '&quot;' ; $ js_rep_table [ '"' ] = '\\"' ; $ js_rep_table [ "'" ] = "\\'" ; $ js_rep_table [ "\\" ] = "\\\\" ; // Unicode line and paragraph separators (#1486310) $ js_rep_table [ chr ( hexdec ( 'E2' ) ) . chr ( hexdec ( '80' ) ) . chr ( hexdec ( 'A8' ) ) ] = '&#8232;' ; $ js_rep_table [ chr ( hexdec ( 'E2' ) ) . chr ( hexdec ( '80' ) ) . chr ( hexdec ( 'A9' ) ) ] = '&#8233;' ; } // encode for javascript use if ( $ enctype == 'js' ) { return preg_replace ( array ( "/\r?\n/" , "/\r/" , '/<\\//' ) , array ( '\n' , '\n' , '<\\/' ) , strtr ( $ str , $ js_rep_table ) ) ; } // encode for plaintext if ( $ enctype == 'text' ) { return str_replace ( "\r\n" , "\n" , $ mode == 'remove' ? strip_tags ( $ str ) : $ str ) ; } if ( $ enctype == 'url' ) { return rawurlencode ( $ str ) ; } // encode for XML if ( $ enctype == 'xml' ) { return strtr ( $ str , $ xml_rep_table ) ; } // no encoding given -> return original string return $ str ; }
Replacing specials characters to a specific encoding type

@param string  Input string
@param string  Encoding type: text|html|xml|js|url
@param string  Replace mode for tags: show|remove|strict
@param boolean Convert newlines

@return string The quoted string
Replacing specials characters to a specific encoding type