Escape request and database values in forms and links.

Add form_value() in html.lib.php.
2026-09-25 21:36:27 +02:00
parent 00e1829f8b
commit f6bdf10228
9 changed files with 37 additions and 29 deletions
@@ -0,0 +1,11 @@
+<?php
+// Escape plain text for HTML (existing entities such as &hellip; are kept)
+function h($string) {
+  return htmlspecialchars((string)$string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8', FALSE);
+}
+
+// Escape a raw value for an attribute or a textarea, so that it comes back unchanged
+function form_value($string) {
+  return htmlspecialchars((string)$string, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+}
+?>