string conversion | ||||
JavaScript | ||||
| ||||
PHP | ||||
qesc(s,n) | ||||
<title><?php echo qesc($s,0); ?></title> <textarea><?php echo qesc($s,0); ?></textarea> <div><?php echo qesc($s,8); ?></div> <div style='font-family:courier new'><?php echo qesc($s,9); ?></div> <inpute value='<?php echo qesc($s,1); ?>'> <inpute value="<?php echo qesc($s,2); ?>"> <meta name='twitter:image' content='<?php echo $s; ?>'> f('<?php echo qesc($s,3); ?>'); f("<?php echo qesc($s,4); ?>"); $h = "onclick=\"i('".qesc($s,5)."');\""; onclick="f('<?php echo qesc($s,5); ?>');" $h = "onclick='j(\"".qesc($s,6)."\");'"; onclick='f("<?php echo qesc($s,6); ?>");' $q = "INSERT INTO t SET c='".qesc($s,7)."'"; | ||||
<?php function qesc($s,$m) { switch($m) { case 0: $s= str_replace("&" ,"&" ,$s); return $s; case 8: $s= str_replace("&" ,"&" ,$s); $s= str_replace("<" ,"<" ,$s); $s= str_replace(">" ,">" ,$s); return $s; case 9: $s= str_replace("&" ,"&" ,$s); $s= str_replace("<" ,"<" ,$s); $s= str_replace(">" ,">" ,$s); $s= str_replace("\n ","<br> ",$s); $s= str_replace("\n" ,"<br>",$s); $s= str_replace("\t"," ",$s); $s= str_replace(" " ," ",$s); $s= str_replace(" " ," ",$s); return $s; case 1: $s= str_replace("&" ,"&" ,$s); $s= str_replace("'" ,"'",$s); return $s; case 2: $s= str_replace("&" ,"&" ,$s); $s= str_replace("\"",""",$s); return $s; case 3: $s= str_replace("\\","\\\\" ,$s); $s= str_replace("'" ,"\'" ,$s); $s= str_replace("\n","\\n" ,$s); $s= str_replace("\r","\\r" ,$s); $s= preg_replace("/<\/(script)>/i","<\\u002F$1>",$s); return $s; case 4: $s= str_replace("\\","\\\\" ,$s); $s= str_replace("\"","\\\"" ,$s); $s= str_replace("\n","\\n" ,$s); $s= str_replace("\r","\\r" ,$s); $s= preg_replace("/<\/(script)>/i","<\\u002F$1>",$s); return $s; case 5: $s= str_replace("\\","\\\\" ,$s); $s= str_replace("'" ,"\'" ,$s); $s= str_replace("\n","\\n" ,$s); $s= str_replace("\r","\\r" ,$s); $s= str_replace("&" ,"&" ,$s); $s= str_replace("\"",""",$s); return $s; case 6: $s= str_replace("\\","\\\\" ,$s); $s= str_replace("\"","\\\"" ,$s); $s= str_replace("\n","\\n" ,$s); $s= str_replace("\r","\\r" ,$s); $s= str_replace("&" ,"&" ,$s); $s= str_replace("'" ,"'",$s); return $s; case 7: $s= mysql_real_escape_string($s); return $s; } } function Q_escape($s,$m) { return qesc($s,$m); } ?> |