FuelPHP Forums

  elseif (is_array($value) || $value instanceof \Iterator || get_class($value) == 'stdClass')
  {
   // Add to $already_cleaned variable when object
   is_object($value) and $already_cleaned[] = $value;

   foreach ($value as $k => $v)
   {
    $value[$k] = static::htmlentities($v);
   }
  }

 public static function htmlentities($value)
 {
  static $already_cleaned = array();

  // Nothing to escape for non-string scalars, or for already processed values
  if (is_bool($value) or is_int($value) or is_float($value) or in_array($value, $already_cleaned, true))
  {
   return $value;
  }

  if (is_string($value))
  {
   $value = htmlentities($value, ENT_COMPAT, \Fuel::$encoding, false);
  }
  elseif (is_array($value) || $value instanceof \Iterator)
  {
   // Add to $already_cleaned variable when object
   is_object($value) and $already_cleaned[] = $value;

   foreach ($value as $k => $v)
   {
    $value[$k] = static::htmlentities($v);
   }
  }
  elseif (is_object($value))
  {
   // Check if the object is whitelisted and return when that's the case
   foreach (\Config::get('security.whitelisted_classes') as $class)
   {
    if (is_a($value, $class))
    {
     // Add to $already_cleaned variable
     $already_cleaned[] = $value;

     return $value;
    }
   }

   // Throw exception when it wasn't whitelisted and can't be converted to String
   if (method_exists($value, '__toString'))
   {
    $value = static::htmlentities((string) $value);
   }
   else if (get_class($value) == 'stdClass')
   {
    foreach ($value as $k => $v)
    {
     if (is_array($value))
     {
      $stdclass = 0;
     }
     else if (get_class($value) == 'stdClass')
     {
      $stdclass = 1;
      $value = (array)$value;
     }

     $value[$k] = static::htmlentities($v);

     if ($stdclass)
     {
      $value = (object)$value;
     }
    }
   }
   else
   {
    throw new \RuntimeException('Object class "'.get_class($value).'" could not be converted to string or '.
     'sanitized as ArrayAcces. Whitelist it in security.whitelisted_classes in app/config/config.php '.
     'to allow it to be passed unchecked.');
   }
  }

  return $value;
 }