浏览代码

[Form] avoid double-escape and then unescape

htmlspecialchars' fourth parameter allows you to avoid double-escaping in the first place
Jordi Boggiano 15 年之前
父节点
当前提交
71cc3a7773
共有 1 个文件被更改,包括 1 次插入13 次删除
  1. 1 13
      src/Symfony/Component/Form/HtmlGenerator.php

+ 1 - 13
src/Symfony/Component/Form/HtmlGenerator.php

@@ -120,18 +120,6 @@ class HtmlGenerator implements HtmlGeneratorInterface
      */
     public function escape($value)
     {
-        return $this->fixDoubleEscape(htmlspecialchars((string) $value, ENT_QUOTES, $this->charset));
-    }
-
-    /**
-     * Fixes double escaped strings.
-     *
-     * @param  string $escaped  string to fix
-     *
-     * @return string A single escaped string
-     */
-    protected function fixDoubleEscape($escaped)
-    {
-        return preg_replace('/&([a-z]+|(#\d+)|(#x[\da-f]+));/i', '&$1;', $escaped);
+        return htmlspecialchars((string) $value, ENT_QUOTES, $this->charset, false);
     }
 }