summaryrefslogtreecommitdiffstats
path: root/system
diff options
context:
space:
mode:
Diffstat (limited to 'system')
-rwxr-xr-xsystem/core/Security.php12
-rw-r--r--system/helpers/form_helper.php7
-rw-r--r--system/helpers/typography_helper.php10
3 files changed, 19 insertions, 10 deletions
diff --git a/system/core/Security.php b/system/core/Security.php
index 342455f27..e99418bdd 100755
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -525,9 +525,17 @@ class CI_Security {
* @param string
* @return string
*/
- public function entity_decode($str, $charset='UTF-8')
+ public function entity_decode($str, $charset = NULL)
{
- if (stristr($str, '&') === FALSE) return $str;
+ if (stristr($str, '&') === FALSE)
+ {
+ return $str;
+ }
+
+ if (empty($charset))
+ {
+ $charset = config_item('charset');
+ }
// The reason we are not using html_entity_decode() by itself is because
// while it is not technically correct to leave out the semicolon
diff --git a/system/helpers/form_helper.php b/system/helpers/form_helper.php
index d9305c00b..130daee6a 100644
--- a/system/helpers/form_helper.php
+++ b/system/helpers/form_helper.php
@@ -642,11 +642,8 @@ if ( ! function_exists('form_prep'))
{
return $str;
}
-
- $str = htmlspecialchars($str);
-
- // In case htmlspecialchars misses these.
- $str = str_replace(array("'", '"'), array("'", """), $str);
+
+ $str = html_escape($str);
if ($field_name != '')
{
diff --git a/system/helpers/typography_helper.php b/system/helpers/typography_helper.php
index 19b4eec03..82e686e53 100644
--- a/system/helpers/typography_helper.php
+++ b/system/helpers/typography_helper.php
@@ -39,9 +39,7 @@ if ( ! function_exists('nl2br_except_pre'))
function nl2br_except_pre($str)
{
$CI =& get_instance();
-
$CI->load->library('typography');
-
return $CI->typography->nl2br_except_pre($str);
}
}
@@ -82,9 +80,15 @@ if ( ! function_exists('auto_typography'))
*/
if ( ! function_exists('entity_decode'))
{
- function entity_decode($str, $charset='UTF-8')
+ function entity_decode($str, $charset = NULL)
{
global $SEC;
+
+ if (empty($charset))
+ {
+ $charset = config_item('charset');
+ }
+
return $SEC->entity_decode($str, $charset);
}
}