API: (bug 19004) Add support for tags. Patch by Matthew Britton

[lhc/web/wiklou.git] / includes / Html.php

diff --git a/includes/Html.php b/includes/Html.php
index 821822c..9573269 100644 (file)
--- a/includes/Html.php
+++ b/includes/Html.php
@@ -99,8 +99,8 @@ class Html {
         *
         * @param $element  string The element's name, e.g., 'a'
         * @param $attribs  array  Associative array of attributes, e.g., array(
-        *   'href' => 'http://www.mediawiki.org/' ).  Values will be HTML-escaped.
-        *   A value of false means to omit the attribute.
+        *   'href' => 'http://www.mediawiki.org/' ).  See expandAttributes() for
+        *   further documentation.
         * @param $contents string The raw HTML contents of the element: *not*
         *   escaped!
         * @return string Raw HTML
@@ -192,7 +192,8 @@ class Html {
         *
         * @param $element string Name of the element, e.g., 'a'
         * @param $attribs array  Associative array of attributes, e.g., array(
-        *   'href' => 'http://www.mediawiki.org/' ).
+        *   'href' => 'http://www.mediawiki.org/' ).  See expandAttributes() for
+        *   further documentation.
         * @return array An array of attributes functionally identical to $attribs
         */
        private static function dropDefaults( $element, $attribs ) {
@@ -290,7 +291,9 @@ class Html {
         *
         * @param $attribs array Associative array of attributes, e.g., array(
         *   'href' => 'http://www.mediawiki.org/' ).  Values will be HTML-escaped.
-        *   A value of false means to omit the attribute.
+        *   A value of false means to omit the attribute.  For boolean attributes,
+        *   you can omit the key, e.g., array( 'checked' ) instead of
+        *   array( 'checked' => 'checked' ) or such.
         * @return string HTML fragment that goes between element name and '>'
         *   (starting with a space if at least one attribute is output)
         */
@@ -350,17 +353,23 @@ class Html {
                                # and we don't need <> escaped here, we may as well not call
                                # htmlspecialchars().  FIXME: verify that we actually need to
                                # escape \n\r\t here, and explain why, exactly.
-                               if ( $wgHtml5 ) {
-                                       $ret .= " $key=$quote" . strtr( $value, array(
-                                               '&' => '&amp;',
-                                               '"' => '&quot;',
-                                               "\n" => '&#10;',
-                                               "\r" => '&#13;',
-                                               "\t" => '&#9;'
-                                       ) ) . $quote;
-                               } else {
-                                       $ret .= " $key=$quote" . Sanitizer::encodeAttribute( $value ) . $quote;
+                               #
+                               # We could call Sanitizer::encodeAttribute() for this, but we
+                               # don't because we're stubborn and like our marginal savings on
+                               # byte size from not having to encode unnecessary quotes.
+                               $map = array(
+                                       '&' => '&amp;',
+                                       '"' => '&quot;',
+                                       "\n" => '&#10;',
+                                       "\r" => '&#13;',
+                                       "\t" => '&#9;'
+                               );
+                               if ( $wgWellFormedXml ) {
+                                       # '<' must be escaped in attributes for XML for some
+                                       # reason, per spec: http://www.w3.org/TR/xml/#NT-AttValue
+                                       $map['<'] = '&lt;';
                                }
+                               $ret .= " $key=$quote" . strtr( $value, $map ) . $quote;
                        }
                }
                return $ret;