Escape single quotes in attributes

[lhc/web/wiklou.git] / includes / Html.php

diff --git a/includes/Html.php b/includes/Html.php
index 8fe4dbe..0988b05 100644 (file)
--- a/includes/Html.php
+++ b/includes/Html.php
@@ -544,28 +544,7 @@ class Html {
                        if ( in_array( $key, self::$boolAttribs ) ) {
                                $ret .= " $key=\"\"";
                        } else {
-                               // Apparently we need to entity-encode \n, \r, \t, although the
-                               // spec doesn't mention that.  Since we're doing strtr() anyway,
-                               // we may as well not call htmlspecialchars().
-                               // @todo FIXME: Verify that we actually need to
-                               // escape \n\r\t here, and explain why, exactly.
-                               // We could call Sanitizer::encodeAttribute() for this, but we
-                               // don't because we're stubborn and like our marginal savings on
-                               // byte size from not having to encode unnecessary quotes.
-                               // The only difference between this transform and the one by
-                               // Sanitizer::encodeAttribute() is ' is not encoded.
-                               $map = [
-                                       '&' => '&',
-                                       '"' => '"',
-                                       '>' => '>',
-                                       // '<' allegedly allowed per spec
-                                       // but breaks some tools if not escaped.
-                                       "<" => '&lt;',
-                                       "\n" => '&#10;',
-                                       "\r" => '&#13;',
-                                       "\t" => '&#9;'
-                               ];
-                               $ret .= " $key=$quote" . strtr( $value, $map ) . $quote;
+                               $ret .= " $key=$quote" . Sanitizer::encodeAttribute( $value ) . $quote;
                        }
                }
                return $ret;