Changeset 7495

Timestamp:

May 29, 2008, 8:16:52 PM (15 years ago)

Author:

ebihara

Message:

#2585:util_output_xml4array()の時点でXMLの要素の内容をエスケープするようにした

File:

• OpenPNE/branches/stable-2.12.x/webapp/lib/util/util.php (modified) (3 diffs)

OpenPNE/branches/stable-2.12.x/webapp/lib/util/util.php

@@ -854 +854 @@
 }
 
-function util_output_xml4array($data, $root)
+function util_output_xml4array($data, $root, $ignore_escape_list = array())
 {
     require_once 'XML/Serializer.php';
@@ -862 +862 @@
     $serializer = new XML_Serializer($option);
 
+    $data = util_escape4output_xml($data, $ignore_escape_list);
+
     $result = $serializer->serialize($data);
 
@@ -872 +874 @@
 
     util_send_header_internal_server_error();
+}
+
+function util_escape4output_xml($data, $ignore_keys = array())
+{
+    if (is_array($data)) {
+        foreach ($data as $key => $value) {
+            if (in_array($key, $ignore_keys)) {
+                $data[$key] = $value;
+            } else {
+                $data[$key] = util_escape4output_xml($value);
+            }
+        }
+    }
+
+    if (is_string($data)) {
+        return htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
+    }
+
+    return $data;
 }