From 983c48ec64a362aa3f93830da0c904877f28c9d5 Mon Sep 17 00:00:00 2001
From: mohrt <mohrt@localhost>
Date: Sat, 10 Feb 2001 23:14:29 +0000
Subject: [PATCH] updated php escape to handle <script language="php">

---
 Smarty.class.php      | 12 +++++++-----
 libs/Smarty.class.php | 12 +++++++-----
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/Smarty.class.php b/Smarty.class.php
index a3274056..2dd6ef8f 100644
--- a/Smarty.class.php
+++ b/Smarty.class.php
@@ -517,15 +517,17 @@ class Smarty
         /* loop through text blocks */
         for($curr_tb = 0; $curr_tb <= count($text_blocks); $curr_tb++) {
             /* match anything within <? ?> */
-            if(preg_match_all('!(<\?[^?]*?\?>)!i',$text_blocks[$curr_tb],$sp_match)) {
+            if(preg_match_all('!(<\?[^?]*?\?>|<script\s+language\s*=\s*[\"\']?php[\"\']?\s*>)!i',$text_blocks[$curr_tb],$sp_match)) {
                 /* found at least one match, loop through each one */
                 foreach($sp_match[0] as $curr_sp) {
-                    if(!$this->allow_php)
+                    if(!$this->allow_php) {
                         /* we don't allow php, so echo anything in <? ?> */
-                        $text_blocks[$curr_tb] = str_replace($curr_sp,'<?php echo \''.addslashes($curr_sp).'\'; ?>',$text_blocks[$curr_tb]);
-                    elseif(!preg_match("!^<\?(php | )!i",$curr_sp))
+                        $text_blocks[$curr_tb] = str_replace($curr_sp,'<?php echo \''.str_replace("'","\'",$curr_sp).'\'; ?>',$text_blocks[$curr_tb]);
+                        /* echo <script language=php> tag */
+                    }                    
+                    elseif(!preg_match("!^(<\?(php | )|<script\s*language\s*=\s*[\"\']?php[\"\']?\s*>)!i",$curr_sp))
                         /* we allow php, so echo only non-php such as <?xml ?> */
-                        $text_blocks[$curr_tb] = str_replace($curr_sp,'<?php echo \''.addslashes($curr_sp).'\'; ?>',$text_blocks[$curr_tb]);
+                        $text_blocks[$curr_tb] = str_replace($curr_sp,'<?php echo \''.str_replace("'","\'",$curr_sp).'\'; ?>',$text_blocks[$curr_tb]);
                 }
             }
         }
diff --git a/libs/Smarty.class.php b/libs/Smarty.class.php
index a3274056..2dd6ef8f 100644
--- a/libs/Smarty.class.php
+++ b/libs/Smarty.class.php
@@ -517,15 +517,17 @@ class Smarty
         /* loop through text blocks */
         for($curr_tb = 0; $curr_tb <= count($text_blocks); $curr_tb++) {
             /* match anything within <? ?> */
-            if(preg_match_all('!(<\?[^?]*?\?>)!i',$text_blocks[$curr_tb],$sp_match)) {
+            if(preg_match_all('!(<\?[^?]*?\?>|<script\s+language\s*=\s*[\"\']?php[\"\']?\s*>)!i',$text_blocks[$curr_tb],$sp_match)) {
                 /* found at least one match, loop through each one */
                 foreach($sp_match[0] as $curr_sp) {
-                    if(!$this->allow_php)
+                    if(!$this->allow_php) {
                         /* we don't allow php, so echo anything in <? ?> */
-                        $text_blocks[$curr_tb] = str_replace($curr_sp,'<?php echo \''.addslashes($curr_sp).'\'; ?>',$text_blocks[$curr_tb]);
-                    elseif(!preg_match("!^<\?(php | )!i",$curr_sp))
+                        $text_blocks[$curr_tb] = str_replace($curr_sp,'<?php echo \''.str_replace("'","\'",$curr_sp).'\'; ?>',$text_blocks[$curr_tb]);
+                        /* echo <script language=php> tag */
+                    }                    
+                    elseif(!preg_match("!^(<\?(php | )|<script\s*language\s*=\s*[\"\']?php[\"\']?\s*>)!i",$curr_sp))
                         /* we allow php, so echo only non-php such as <?xml ?> */
-                        $text_blocks[$curr_tb] = str_replace($curr_sp,'<?php echo \''.addslashes($curr_sp).'\'; ?>',$text_blocks[$curr_tb]);
+                        $text_blocks[$curr_tb] = str_replace($curr_sp,'<?php echo \''.str_replace("'","\'",$curr_sp).'\'; ?>',$text_blocks[$curr_tb]);
                 }
             }
         }