diff --git a/nel/include/nel/gui/html_element.h b/nel/include/nel/gui/html_element.h index cc59d2126..9a26938af 100644 --- a/nel/include/nel/gui/html_element.h +++ b/nel/include/nel/gui/html_element.h @@ -76,7 +76,7 @@ namespace NLGUI void reindexChilds(); // escape text tag or attribute value - std::string htmlEscape(std::string val, bool isAttribute = false) const; + std::string htmlEscape(const std::string &val) const; // serialize element attributes as string std::string serializeAttributes() const; diff --git a/nel/src/gui/html_element.cpp b/nel/src/gui/html_element.cpp index 8eb706cc9..a8038be7d 100644 --- a/nel/src/gui/html_element.cpp +++ b/nel/src/gui/html_element.cpp @@ -142,26 +142,29 @@ namespace NLGUI } // *************************************************************************** - std::string CHtmlElement::htmlEscape(std::string val, bool isAttribute) const + std::string CHtmlElement::htmlEscape(const std::string &val) const { - static const std::string searchReplace[] = { - "&", "&", - "<", "<", - ">", ">", - "\xA0", " ", - }; - - for(uint i = 0; i < (sizeof(searchReplace) / sizeof(searchReplace[0])); i+=2) - val = strFindReplaceAll(val, searchReplace[i], searchReplace[i+1]); - - if (isAttribute) + if (val.find_first_of("\"'&<>\xA0") == std::string::npos) + return val; + + std::string ret; + // resize is quaranteed, make room for some free replacements + ret.reserve(val.size() + 24); + for(size_t pos = 0; pos != val.size(); pos++) { - static const std::string q = "\""; - static const std::string quot = """; - val = strFindReplaceAll(val, q, quot); + switch(val[pos]) + { + case '"': ret.append("""); break; + case '\'': ret.append("'"); break; + case '&': ret.append("&"); break; + case '<': ret.append("<"); break; + case '>': ret.append(">"); break; + case '\xA0': ret.append(" "); break; + default : ret.append(&val[pos],1); break; + } } - return val; + return ret; } // *************************************************************************** @@ -179,13 +182,13 @@ namespace NLGUI { result += " "; } - result += htmlEscape(*it2, true); + result += htmlEscape(*it2); } result += "\""; } else { - result += " " + it->first + "=\"" + htmlEscape(it->second, true) + "\""; + result += " " + it->first + "=\"" + htmlEscape(it->second) + "\""; } } return result;