From 4a5173151d4ee3e923a9f5fba85f2aaa77cf8d34 Mon Sep 17 00:00:00 2001
From: fabien <fabien@93ef8e89-cb99-4229-a87c-7fa0fa45744b>
Date: Tue, 20 Oct 2009 04:25:01 +0000
Subject: [PATCH] added a js escaping strategy

git-svn-id: http://svn.twig-project.org/trunk@81 93ef8e89-cb99-4229-a87c-7fa0fa45744b
---
 bin/create_pear_package.php |    3 ---
 lib/Twig/runtime.php        |   26 ++++++++++++++++++++++++--
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/bin/create_pear_package.php b/bin/create_pear_package.php
index e9ebf6c..0ed7a89 100644
--- a/bin/create_pear_package.php
+++ b/bin/create_pear_package.php
@@ -1,8 +1,5 @@
 <?php
 
-require_once dirname(__FILE__).'/../lib/Twig/Autoloader.php';
-Twig_Autoloader::register();
-
 if (!isset($argv[1]))
 {
   die('You must provide the version (1.0.0)');
diff --git a/lib/Twig/runtime.php b/lib/Twig/runtime.php
index 02b492d..c41f60f 100644
--- a/lib/Twig/runtime.php
+++ b/lib/Twig/runtime.php
@@ -99,14 +99,36 @@ function twig_sort_filter($array)
   return $array;
 }
 
-function twig_escape_filter(Twig_Environment $env, $string)
+/*
+ * Each type specifies a way for applying a transformation to a string
+ * The purpose is for the string to be "escaped" so it is suitable for
+ * the format it is being displayed in.
+ *
+ * For example, the string: "It's required that you enter a username & password.\n"
+ * If this were to be displayed as HTML it would be sensible to turn the
+ * ampersand into '&amp;' and the apostrophe into '&aps;'. However if it were
+ * going to be used as a string in JavaScript to be displayed in an alert box
+ * it would be right to leave the string as-is, but c-escape the apostrophe and
+ * the new line.
+ */
+function twig_escape_filter(Twig_Environment $env, $string, $type = 'html')
 {
   if (!is_string($string))
   {
     return $string;
   }
 
-  return htmlspecialchars($string, ENT_QUOTES, $env->getCharset());
+  switch ($type)
+  {
+    case 'js':
+      // a function the c-escapes a string, making it suitable to be placed in a JavaScript string
+      return str_replace(array("\\"  , "\n"  , "\r" , "\""  , "'"),
+                         array("\\\\", "\\n" , "\\r", "\\\"", "\\'"),
+                         $string);
+    case 'html':
+    default:
+      return htmlspecialchars($string, ENT_QUOTES, $env->getCharset());
+  }
 }
 
 // add multibyte extensions if possible
-- 
1.7.2.5