[Form] Escape value in textField #276

windwalker-io · Apr 2, 2016 · dae335c · dae335c
1 parent e0b2115
commit dae335c
Show file tree

Hide file tree

Showing 4 changed files with 17 additions and 3 deletions.
diff --git a/src/Form/Field/AbstractField.php b/src/Form/Field/AbstractField.php
@@ -935,4 +935,18 @@ public function setForm($form)
 
 		return $this;
 	}
+
+	/**
+	 * Escape html string.
+	 *
+	 * @param   string  $text
+	 *
+	 * @return  string
+	 *
+	 * @since  2.1.9
+	 */
+	public function escape($text)
+	{
+		return htmlspecialchars($text, ENT_COMPAT, 'UTF-8');
+	}
 }
diff --git a/src/Form/Field/TextField.php b/src/Form/Field/TextField.php
@@ -43,7 +43,7 @@ public function prepare(&$attrs)
 		$attrs['readonly'] = $this->getAttribute('readonly');
 		$attrs['disabled'] = $this->getAttribute('disabled');
 		$attrs['onchange'] = $this->getAttribute('onchange');
-		$attrs['value']    = $this->getValue();
+		$attrs['value']    = $this->escape($this->getValue());
 		$attrs['required'] = $this->required;
 
 		$attrs = array_merge($attrs, (array) $this->getAttribute('attribs'));

diff --git a/src/Form/Test/Field/TextFieldTest.php b/src/Form/Test/Field/TextFieldTest.php
@@ -72,7 +72,7 @@ protected function tearDown()
 	public function testRender()
 	{
 		$html = <<<HTML
-<input type="text" name="flower" id="test-field" class="stub-flower" placeholder="th" size="60" maxlength="10" readonly="readonly" disabled="disabled" onchange="javascript:void(0);" data-test-element />
+<input type="text" name="flower" id="test-field" class="stub-flower" placeholder="th" size="60" maxlength="10" readonly="readonly" disabled="disabled" onchange="javascript:void(0);" value="" data-test-element />
 HTML;
 
 		$this->assertDomStringEqualsDomString($html, $this->instance->renderInput());

diff --git a/src/Form/Test/FormTest.php b/src/Form/Test/FormTest.php
@@ -509,7 +509,7 @@ public function testRenderField()
 	{
 		$form = $this->getByDefine('windwalker');
 
-		$html = '<div id="input-windwalker-id-control" class="text-field "><label id="input-windwalker-id-label" for="input-windwalker-id">ID</label><input type="text" name="windwalker[id]" id="input-windwalker-id" class="control-input" /></div>';
+		$html = '<div id="input-windwalker-id-control" class="text-field "><label id="input-windwalker-id-label" for="input-windwalker-id">ID</label><input type="text" name="windwalker[id]" id="input-windwalker-id" class="control-input" value="" /></div>';
 
 		$this->assertEquals($html, $form->renderField('id'));