Mirrors/yii
2
0
Fork 0
mirror of https://github.com/yiisoft/yii.git synced 2026-03-06 16:16:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Enh #551: Added $safe parameter to CJavaScript::encode. If set to true, 'js:' will not be allowed

Browse Source
This commit is contained in:
Alexander Makarov
2012-07-26 01:25:54 +04:00
parent 941d435ef4
commit c1ac363f76
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
framework/web/helpers/CJavaScript.php
View File

@@ -48,14 +48,18 @@ class CJavaScript
* For highly complex data structures use {@link jsonEncode} and {@link jsonDecode}
* to serialize and unserialize.
*
* If you are encoding user input, make sure $safe is set to true.
*
* @param mixed $value PHP variable to be encoded
* @param boolean $safe If true, 'js:' will not be allowed.
* Default is false. This parameter is available since 1.1.11.
* @return string the encoded string
*/
public static function encode($value)
public static function encode($value,$safe=false)
{
if(is_string($value))
{
if(strpos($value,'js:')===0)
if(strpos($value,'js:')===0 && $safe===false)
return substr($value,3);
else
return "'".self::quote($value)."'";