| 1 |
<?php |
| 2 |
|
| 3 |
namespace FluentCart\OpenSpout\Common\Helper\Escaper; |
| 4 |
|
| 5 |
/** |
| 6 |
* Provides functions to escape and unescape data for ODS files. |
| 7 |
*/ |
| 8 |
class ODS implements EscaperInterface |
| 9 |
{ |
| 10 |
/** |
| 11 |
* Escapes the given string to make it compatible with XLSX. |
| 12 |
* |
| 13 |
* @param string $string The string to escape |
| 14 |
* |
| 15 |
* @return string The escaped string |
| 16 |
*/ |
| 17 |
public function escape($string) |
| 18 |
{ |
| 19 |
// @NOTE: Using ENT_QUOTES as XML entities ('<', '>', '&') as well as |
| 20 |
// single/double quotes (for XML attributes) need to be encoded. |
| 21 |
if (\defined('ENT_DISALLOWED')) { |
| 22 |
/** |
| 23 |
* 'ENT_DISALLOWED' ensures that invalid characters in the given document type are replaced. |
| 24 |
* Otherwise control characters like a vertical tab "\v" will make the XML document unreadable by the XML processor. |
| 25 |
* |
| 26 |
* @see https://github.com/box/spout/issues/329 |
| 27 |
*/ |
| 28 |
$replacedString = \htmlspecialchars($string, \ENT_QUOTES | \ENT_DISALLOWED, 'UTF-8'); |
| 29 |
} else { |
| 30 |
// We are on hhvm or any other engine that does not support ENT_DISALLOWED. |
| 31 |
$escapedString = \htmlspecialchars($string, \ENT_QUOTES, 'UTF-8'); |
| 32 |
// control characters values are from 0 to 1F (hex values) in the ASCII table |
| 33 |
// some characters should not be escaped though: "\t", "\r" and "\n". |
| 34 |
$regexPattern = '[\\x00-\\x08' . '\\x0B-\\x0C' . '\\x0E-\\x1F]'; |
| 35 |
$replacedString = \preg_replace("/{$regexPattern}/", '�', $escapedString); |
| 36 |
} |
| 37 |
return $replacedString; |
| 38 |
} |
| 39 |
/** |
| 40 |
* Unescapes the given string to make it compatible with XLSX. |
| 41 |
* |
| 42 |
* @param string $string The string to unescape |
| 43 |
* |
| 44 |
* @return string The unescaped string |
| 45 |
*/ |
| 46 |
public function unescape($string) |
| 47 |
{ |
| 48 |
// ============== |
| 49 |
// = WARNING = |
| 50 |
// ============== |
| 51 |
// It is assumed that the given string has already had its XML entities decoded. |
| 52 |
// This is true if the string is coming from a DOMNode (as DOMNode already decode XML entities on creation). |
| 53 |
// Therefore there is no need to call "htmlspecialchars_decode()". |
| 54 |
return $string; |
| 55 |
} |
| 56 |
} |
| 57 |
|
