Fixed the bug that TXmlElement did not encode attribute and text values when being saved as a string

1 files changed, 18 insertions, 2 deletions

diff --git a/framework/Xml/TXmlDocument.php b/framework/Xml/TXmlDocument.php
index cc5b40f9..b4293763 100644
--- a/framework/Xml/TXmlDocument.php
+++ b/framework/Xml/TXmlDocument.php
@@ -200,7 +200,10 @@ class TXmlElement extends TComponent
 		if($this->_attributes!==null)
 		{
 			foreach($this->_attributes as $name=>$value)
+			{
+				$value=$this->xmlEncode($value);
 				$attr.=" $name=\"$value\"";
+			}
 		}
 		$prefix=str_repeat(' ',$indent*4);
 		if($this->getHasElement())
@@ -211,13 +214,26 @@ class TXmlElement extends TComponent
 			$str.=$prefix."</{$this->_tagName}>";
 			return $str;
 		}
-		else if($this->getValue()!=='')
+		else if(($value=$this->getValue())!=='')
 		{
-			return $prefix."<{$this->_tagName}$attr>{$this->_value}</{$this->_tagName}>";
+			$value=$this->xmlEncode($value);
+			return $prefix."<{$this->_tagName}$attr>$value</{$this->_tagName}>";
 		}
 		else
 			return $prefix."<{$this->_tagName}$attr />";
 	}
+
+	private function xmlEncode($str)
+	{
+		return strtr($str,array(
+			'>'=>'&gt;',
+			'<'=>'&lt;',
+			'&'=>'&amp;',
+			'"'=>'&quot;',
+			"\r"=>'&#xA;',
+			"\t"=>'&#x9;',
+			"\n"=>'&#xD;'));
+	}
 }
 
 /**