Revert 7c4d10660a0a47446474bf97e3cb65f80693f1ee
Deprecates form_prep() in favor of html_escape() (again).
Related: issue #1953, which was the reason for the reverted commit,
but was wrongly interpreted and that shouldn't have happened.
Close #2477
diff --git a/system/helpers/form_helper.php b/system/helpers/form_helper.php
index 0e9207e..007db4c 100644
--- a/system/helpers/form_helper.php
+++ b/system/helpers/form_helper.php
@@ -100,7 +100,7 @@
{
foreach ($hidden as $name => $value)
{
- $form .= '<input type="hidden" name="'.$name.'" value="'.form_prep($value).'" style="display:none;" />'."\n";
+ $form .= '<input type="hidden" name="'.$name.'" value="'.html_escape($value).'" style="display:none;" />'."\n";
}
}
@@ -173,7 +173,7 @@
if ( ! is_array($value))
{
- $form .= '<input type="hidden" name="'.$name.'" value="'.form_prep($value)."\" />\n";
+ $form .= '<input type="hidden" name="'.$name.'" value="'.html_escape($value)."\" />\n";
}
else
{
@@ -287,7 +287,7 @@
unset($data['value']); // textareas don't use the value attribute
}
- return '<textarea '._parse_form_attributes($data, $defaults).$extra.'>'.form_prep($val, TRUE)."</textarea>\n";
+ return '<textarea '._parse_form_attributes($data, $defaults).$extra.'>'.html_escape($val)."</textarea>\n";
}
}
@@ -392,7 +392,7 @@
foreach ($val as $optgroup_key => $optgroup_val)
{
$sel = in_array($optgroup_key, $selected) ? ' selected="selected"' : '';
- $form .= '<option value="'.form_prep($optgroup_key).'"'.$sel.'>'
+ $form .= '<option value="'.html_escape($optgroup_key).'"'.$sel.'>'
.(string) $optgroup_val."</option>\n";
}
@@ -400,7 +400,7 @@
}
else
{
- $form .= '<option value="'.form_prep($key).'"'
+ $form .= '<option value="'.html_escape($key).'"'
.(in_array($key, $selected) ? ' selected="selected"' : '').'>'
.(string) $val."</option>\n";
}
@@ -653,28 +653,13 @@
*
* Formats text so that it can be safely placed in a form field in the event it has HTML tags.
*
+ * @deprecated 3.0.0 An alias for html_escape()
* @param string|string[] $str Value to escape
- * @param bool $is_textarea Whether we're escaping for a textarea element
* @return string|string[] Escaped values
*/
- function form_prep($str = '', $is_textarea = FALSE)
+ function form_prep($str)
{
- if (is_array($str))
- {
- foreach (array_keys($str) as $key)
- {
- $str[$key] = form_prep($str[$key], $is_textarea);
- }
-
- return $str;
- }
-
- if ($is_textarea === TRUE)
- {
- return str_replace(array('<', '>'), array('<', '>'), stripslashes($str));
- }
-
- return str_replace(array("'", '"'), array(''', '"'), stripslashes($str));
+ return html_escape($str, TRUE);
}
}
@@ -691,10 +676,9 @@
*
* @param string $field Field name
* @param string $default Default value
- * @param bool $is_textarea Whether the field is a textarea element
* @return string
*/
- function set_value($field = '', $default = '', $is_textarea = FALSE)
+ function set_value($field, $default = '')
{
$CI =& get_instance();
@@ -702,7 +686,7 @@
? $CI->form_validation->set_value($field, $default)
: $CI->input->post($field, FALSE);
- return form_prep($value === NULL ? $default : $value, $is_textarea);
+ return html_escape($value === NULL ? $default : $value);
}
}
@@ -721,7 +705,7 @@
* @param bool
* @return string
*/
- function set_select($field = '', $value = '', $default = FALSE)
+ function set_select($field, $value = '', $default = FALSE)
{
$CI =& get_instance();
@@ -768,7 +752,7 @@
* @param bool
* @return string
*/
- function set_checkbox($field = '', $value = '', $default = FALSE)
+ function set_checkbox($field, $value = '', $default = FALSE)
{
$CI =& get_instance();
@@ -815,7 +799,7 @@
* @param bool $default
* @return string
*/
- function set_radio($field = '', $value = '', $default = FALSE)
+ function set_radio($field, $value = '', $default = FALSE)
{
$CI =& get_instance();
@@ -921,7 +905,7 @@
{
if ($key === 'value')
{
- $val = form_prep($val);
+ $val = html_escape($val);
}
elseif ($key === 'name' && ! strlen($default['name']))
{