Small enhancement to escape:javascript

Hi! As said in XHTML 1.0 / HTML Compatibility Guidelines / Embedded Style Sheets and Scripts http://www.w3.org/TR/xhtml1/#C_4 strings < or & or ]]> or -- are not recommended in embedded scripts. '<', '>' and '&' are prohibited if script section is not properly marked as CDATA. At least '<' is not good for old HTML too (basically, in '</script>' string). So, I think it is good to escape '<','>','&','--' properly in javascript-escaped strings Konstantin Pelepelin Proposed patch: ========== begin diff -u -b -r1.23 modifier.escape.php --- modifier.escape.php 23 Nov 2005 20:36:05 -0000 1.23 +++ modifier.escape.php 26 May 2006 09:44:07 -0000 @@ -62,7 +62,8 @@ case 'javascript': // escape quotes and backslashes, newlines, etc. - return strtr($string, array('\\'=>'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n','</'=>'<\/')); + return strtr($string, array('\\'=>'\\\\',"'"=>"\\'",'"'=>'\\"',"\r"=>'\\r',"\n"=>'\\n', + '<'=>'\\074','>'=>'\\076','&'=>'\\046','--'=>'\\055\\055')); case 'mail': // safe way to display e-mail address on a web page ========== end Complicated test example: ========== begin {assign var='any_user_data' value='malicious </script><script>window.alert("malicious!")</script>'} {capture assign='onclick'} window.alert('{$any_user_data|escape:'javascript'}');return false; {/capture} {capture assign='html'} <a href="#" onclick="{$onclick|escape}">click!</a> {/capture} <script language="JavaScript" type="text/javascript"> document.write('{$html|escape:'javascript'}'); </script> ========== end