/*** Straight-forward strategy: use PHP's tokenizer to escape everything that* looks like PHP.** We open/close PHP tags at the beginning of the template to clearly indicate* that we are in HTML mode.** Known issue: templates need to be rechecked everytime the value of the php.ini* settings asp_tags or short_tags are changed*/do{ $tokens = token_get_all('<?php ?>' . $code); $code = ''; $php_found = false; foreach ($tokens as $i => $token) { if (!is_array($token)) { $code .= $token; } else if ($token[0] == T_OPEN_TAG || $token[0] == T_CLOSE_TAG) { if ($i > 1) { $code .= htmlspecialchars($token[1]); $php_found = true; } } else { $code .= $token[1]; } } unset($tokens); /** * Fix for a tokenizer oddity */ if (!strncmp($code, '<?php ?>', 11)) { $code = substr($code, 11); }}while ($php_found);