P4Cms_View_Helper_EscapeJs Class Reference

View helper for escaping untrusted data before inserting them into a javascript data values. More...

Inheritance diagram for P4Cms_View_Helper_EscapeJs:

List of all members.

Public Member Functions
	escapeJs ($value)
	Returns escaped value that can be safely inserted into a javascript data value.
Protected Member Functions
	_format ($ordinalValue)
	Convert character represented by its ordinal value into if ordinal value less than 256 or into if ordinal value > 255.
Protected Attributes
	$_safeChars = array(',', '.', '_')

---

Detailed Description

View helper for escaping untrusted data before inserting them into a javascript data values.

Copyright:

2011-2012 Perforce Software. All rights reserved

License:

Please see LICENSE.txt in top-level folder of this distribution.

Version:

2012.2/486814

---

Member Function Documentation

P4Cms_View_Helper_EscapeJs::_format

(

$

ordinalValue

)

[protected]

Convert character represented by its ordinal value into if ordinal value less than 256 or into if ordinal value > 255.

Parameters:

int

$ordinalValue

Ordinal value to format.

Reimplemented from P4Cms_View_Helper_EscapeAbstract.

    {
        $hex = strtoupper(dechex($ordinalValue));
        if ($ordinalValue < 256) {
            $padLength = 2;
            $prefix    = "\\x";
        } else {
            $padLength = 4;
            $prefix    = "\\u";
        }
        return $prefix . str_pad($hex, $padLength, "0", STR_PAD_LEFT);
    }

P4Cms_View_Helper_EscapeJs::escapeJs

(

$

value

)

Returns escaped value that can be safely inserted into a javascript data value.

Untrusted data should be escaped before inserting them into html javascript data values:

<script>alert('...ESCAPE_JS...')</script> inside a quoted string <script>x='...ESCAPE_JS...'</script> one side of a quoted expression <div onmouseover="x='...ESCAPE_JS...'" inside quoted event handler

Parameters:

string

$value

Value to escape.

Returns:

string Escaped value safe to insert into a javascript data value.

    {
        return $this->_encode($value);
    }

---

Member Data Documentation

P4Cms_View_Helper_EscapeJs::$_safeChars = array(',', '.', '_') [protected]

Reimplemented from P4Cms_View_Helper_EscapeAbstract.

---

The documentation for this class was generated from the following file:

• EscapeJs.php