正确的转义和本地化形式-函数.php面包屑

时间：2017-09-19 作者：AashikP

我得到了在线生成WordPress面包屑的代码，希望确保在主题中使用它是安全的

<?php //// BREADCRUMB START ////       
 function the_breadcrumb() {

  $showOnHome = 0; // 1 - show breadcrumbs on the homepage, 0 - don\'t show
  $delimiter = \'&raquo;\'; // delimiter between crumbs
  $home = \'Home\'; // text for the \'Home\' link
  $showCurrent = 1; // 1 - show current post/page title in breadcrumbs, 0 - don\'t show
  $before = \'<span class="current">\'; // tag before the current crumb
  $after = \'</span>\'; // tag after the current crumb

  global $post;
  $homeLink = get_bloginfo(\'url\');

  if (is_home() || is_front_page()) {

    if ($showOnHome == 1) echo \'<div id="crumbs"><a href="\' . $homeLink . \'">\' . $home . \'</a></div>\';

  } else {

    echo \'<div id="crumbs"><a href="\' . $homeLink . \'">\' . $home . \'</a> \' . $delimiter . \' \';

    if ( is_category() ) {
      $thisCat = get_category(get_query_var(\'cat\'), false);
      if ($thisCat->parent != 0) echo get_category_parents($thisCat->parent, TRUE, \' \' . $delimiter . \' \');
      echo $before . \'Archive by category "\' . single_cat_title(\'\', false) . \'"\' . $after;

    } elseif ( is_search() ) {
      echo $before . \'Search results for "\' . get_search_query() . \'"\' . $after;

    } elseif ( is_day() ) {
      echo \'<a href="\' . get_year_link(get_the_time(\'Y\')) . \'">\' . get_the_time(\'Y\') . \'</a> \' . $delimiter . \' \';
      echo \'<a href="\' . get_month_link(get_the_time(\'Y\'),get_the_time(\'m\')) . \'">\' . get_the_time(\'F\') . \'</a> \' . $delimiter . \' \';
      echo $before . get_the_time(\'d\') . $after;

    } elseif ( is_month() ) {
      echo \'<a href="\' . get_year_link(get_the_time(\'Y\')) . \'">\' . get_the_time(\'Y\') . \'</a> \' . $delimiter . \' \';
      echo $before . get_the_time(\'F\') . $after;

    } elseif ( is_year() ) {
      echo $before . get_the_time(\'Y\') . $after;

    } elseif ( is_single() && !is_attachment() ) {
      if ( get_post_type() != \'post\' ) {
        $post_type = get_post_type_object(get_post_type());
        $slug = $post_type->rewrite;
        echo \'<a href="\' . $homeLink . \'/\' . $slug[\'slug\'] . \'/">\' . $post_type->labels->singular_name . \'</a>\';
        if ($showCurrent == 1) echo \' \' . $delimiter . \' \' . $before . get_the_title() . $after;
      } else {
        $cat = get_the_category(); $cat = $cat[0];
        $cats = get_category_parents($cat, TRUE, \' \' . $delimiter . \' \');
        if ($showCurrent == 0) $cats = preg_replace("#^(.+)\\s$delimiter\\s$#", "$1", $cats);
        echo $cats;
        if ($showCurrent == 1) echo $before . get_the_title() . $after;
      }

    } elseif ( !is_single() && !is_page() && get_post_type() != \'post\' && !is_404() ) {
      $post_type = get_post_type_object(get_post_type());
      echo $before . $post_type->labels->singular_name . $after;

    } elseif ( is_attachment() ) {
      $parent = get_post($post->post_parent);
      $cat = get_the_category($parent->ID); $cat = $cat[0];
      echo get_category_parents($cat, TRUE, \' \' . $delimiter . \' \');
      echo \'<a href="\' . get_permalink($parent) . \'">\' . $parent->post_title . \'</a>\';
      if ($showCurrent == 1) echo \' \' . $delimiter . \' \' . $before . get_the_title() . $after;

    } elseif ( is_page() && !$post->post_parent ) {
      if ($showCurrent == 1) echo $before . get_the_title() . $after;

    } elseif ( is_page() && $post->post_parent ) {
      $parent_id  = $post->post_parent;
      $breadcrumbs = array();
      while ($parent_id) {
        $page = get_page($parent_id);
        $breadcrumbs[] = \'<a href="\' . get_permalink($page->ID) . \'">\' . get_the_title($page->ID) . \'</a>\';
        $parent_id  = $page->post_parent;
      }
      $breadcrumbs = array_reverse($breadcrumbs);
      for ($i = 0; $i < count($breadcrumbs); $i++) {
        echo $breadcrumbs[$i];
        if ($i != count($breadcrumbs)-1) echo \' \' . $delimiter . \' \';
      }
      if ($showCurrent == 1) echo \' \' . $delimiter . \' \' . $before . get_the_title() . $after;

    } elseif ( is_tag() ) {
      echo $before . \'Posts tagged "\' . single_tag_title(\'\', false) . \'"\' . $after;

    } elseif ( is_author() ) {
       global $author;
      $userdata = get_userdata($author);
      echo $before . \'Articles posted by \' . $userdata->display_name . $after;

    } elseif ( is_404() ) {
      echo $before . \'Error 404\' . $after;
    }

    if ( get_query_var(\'paged\') ) {
      if ( is_category() || is_day() || is_month() || is_year() || is_search() || is_tag() || is_author() ) echo \' (\';
      echo __(\'Page\') . \' \' . get_query_var(\'paged\');
      if ( is_category() || is_day() || is_month() || is_year() || is_search() || is_tag() || is_author() ) echo \')\';
    }

    echo \'</div>\';

  }
} // end the_breadcrumb()

//// BREADCRUMB END ////
?>
我首先关心的是：

  $homeLink = get_bloginfo(\'url\');

  if (is_home() || is_front_page()) {

    if ($showOnHome == 1) echo \'<div id="crumbs"><a href="\' . $homeLink . \'">\' . $home . \'</a></div>\';

  }
应该esc_url 此处使用：

  $homeLink = esc_url(get_bloginfo(\'url\'));

  if (is_home() || is_front_page()) {

    if ($showOnHome == 1) echo \'<div id="crumbs"><a href="\' . $homeLink . \'">\' . $home . \'</a></div>\';

  }
或者应该在我需要的地方使用$homelink

我需要逃跑吗get_category(get_query_var(\'cat\'), false); 此处：

if ( is_category() ) {
  $thisCat = get_category(get_query_var(\'cat\'), false);
  if ($thisCat->parent != 0) echo get_category_parents($thisCat->parent, TRUE, \' \' . $delimiter . \' \');
  echo $before . \'Archive by category "\' . single_cat_title(\'\', false) . \'"\' . $after;

}
或者我应该像这样跳过最后的输出

<?php if ( function_exists( \'the_breadcrumb\' ) ) esc_html(the_breadcrumb()); ?>
5。。关于本地化，我认为所有这些字符串都必须准备好翻译：

按类别存档应为_e(\'Archive by category\', \'theme-slug\')

对吗？

更新了带转义的函数：

<?php //// BREADCRUMB START ////      
     function the_breadcrumb() {

     $showOnHome = 0; // 1 - show breadcrumbs on the homepage, 0 - don\'t show
      $delimiter = \'&raquo;\'; // delimiter between crumbs
      $home = __(\'Home\', \'theme-slug\'); // text for the \'Home\' link
  $showCurrent = 1; // 1 - show current post/page title in breadcrumbs, 0 - don\'t show
  $before = \'<span class="current">\'; // tag before the current crumb
  $after = \'</span>\'; // tag after the current crumb

  global $post;
  $homeLink = get_bloginfo(\'url\');

  if (is_home() || is_front_page()) {

    if ($showOnHome == 1) echo \'<div id="crumbs"><a href="\' . esc_url($homeLink) . \'">\' . $home . \'</a></div>\';

  } else {

    echo \'<div id="crumbs"><a href="\' . esc_url($homeLink) . \'">\' . $home . \'</a> \' . $delimiter . \' \';

    if ( is_category() ) {
      $thisCat = get_category(get_query_var(\'cat\'), false);
      if ($thisCat->parent != 0) echo esc_html(get_category_parents($thisCat->parent, TRUE, \' \' . $delimiter . \' \'));
      echo $before . __(\'Archive by category "\', \'theme-slug\') . esc_html(single_cat_title(\'\', false)) . \'"\' . $after;

    } elseif ( is_search() ) {
      echo $before . __(\'You Searched for "\', \'theme-slug\') . esc_html(get_search_query()) . \'"\' . $after;

    } elseif ( is_day() ) {
      echo \'<a href="\' . get_year_link(get_the_time(\'Y\')) . \'">\' . get_the_time(\'Y\') . \'</a> \' . $delimiter . \' \';
      echo \'<a href="\' . get_month_link(get_the_time(\'Y\'),get_the_time(\'m\')) . \'">\' . get_the_time(\'F\') . \'</a> \' . $delimiter . \' \';
      echo $before . get_the_time(\'d\') . $after;

    } elseif ( is_month() ) {
      echo \'<a href="\' . get_year_link(get_the_time(\'Y\')) . \'">\' . get_the_time(\'Y\') . \'</a> \' . $delimiter . \' \';
      echo $before . get_the_time(\'F\') . $after;

    } elseif ( is_year() ) {
      echo $before . get_the_time(\'Y\') . $after;

    } elseif ( is_single() && !is_attachment() ) {
      if ( get_post_type() != \'post\' ) {
        $post_type = get_post_type_object(get_post_type());
        $slug = $post_type->rewrite;
        echo \'<a href="\' . esc_url($homeLink) . \'/\' . $slug[\'slug\'] . \'/">\' . $post_type->labels->singular_name . \'</a>\';
        if ($showCurrent == 1) echo \' \' . $delimiter . \' \' . $before . esc_html(get_the_title()) . $after;
      } else {
        $cat = get_the_category(); $cat = $cat[0];
        $cats = get_category_parents($cat, TRUE, \' \' . $delimiter . \' \');
        if ($showCurrent == 0) $cats = preg_replace("#^(.+)\\s$delimiter\\s$#", "$1", $cats);
        echo $cats;
        if ($showCurrent == 1) echo $before . esc_html(get_the_title()) . $after;
      }

    } elseif ( !is_single() && !is_page() && get_post_type() != \'post\' && !is_404() ) {
      $post_type = get_post_type_object(get_post_type());
      echo $before . $post_type->labels->singular_name . $after;

    } elseif ( is_attachment() ) {
      $parent = get_post($post->post_parent);
      $cat = get_the_category($parent->ID); $cat = $cat[0];
      echo esc_html(get_category_parents($cat, TRUE, \' \' . $delimiter . \' \'));
      echo \'<a href="\' . esc_url(get_permalink($parent)) . \'">\' . $parent->post_title . \'</a>\';
      if ($showCurrent == 1) echo \' \' . $delimiter . \' \' . $before . esc_html(get_the_title()) . $after;

    } elseif ( is_page() && !$post->post_parent ) {
      if ($showCurrent == 1) echo $before . esc_html(get_the_title()) . $after;

    } elseif ( is_page() && $post->post_parent ) {
      $parent_id  = $post->post_parent;
      $breadcrumbs = array();
      while ($parent_id) {
        $page = get_page($parent_id);
        $breadcrumbs[] = \'<a href="\' . get_permalink($page->ID) . \'">\' . get_the_title($page->ID) . \'</a>\';
        $parent_id  = $page->post_parent;
      }
      $breadcrumbs = array_reverse($breadcrumbs);
      for ($i = 0; $i < count($breadcrumbs); $i++) {
        echo $breadcrumbs[$i];
        if ($i != count($breadcrumbs)-1) echo \' \' . $delimiter . \' \';
      }
      if ($showCurrent == 1) echo \' \' . $delimiter . \' \' . $before . esc_html(get_the_title()) . $after;

    } elseif ( is_tag() ) {
      echo $before . __(\'Posts tagged "\', \'theme-slug\' ) . esc_html(single_tag_title(\'\', false)) . \'"\' . $after;

    } elseif ( is_author() ) {
       global $author;
      $userdata = get_userdata($author);
      echo $before . __(\'Articles posted by\', \'theme-slug\' ) . $userdata->display_name . $after;

    } elseif ( is_404() ) {
      echo $before . __(\'Error 404\', \'theme-slug\' ) . $after;
    }

    if ( get_query_var(\'paged\') ) {
      if ( is_category() || is_day() || is_month() || is_year() || is_search() || is_tag() || is_author() ) echo \' (\';
      echo __(\'Page\', \'theme-slug\') . \' \' . get_query_var(\'paged\');
      if ( is_category() || is_day() || is_month() || is_year() || is_search() || is_tag() || is_author() ) echo \')\';
    }

    echo \'</div>\';

  }
} // end the_breadcrumb()

//// BREADCRUMB END ////
?>

1 个回复
SO网友:Rarst

一般规则是，应尽可能靠近实际输出的位置进行转义。原因是，如果转义与输出相差很远，则假定输出是转义的。。。直到将来某个时候，文件的另一个角落发生了变化，情况不再如此。

应该逃逸什么主要取决于它包含不安全和/或用户生成的输入的可能性有多大。很少显式转义模板标记。在某些情况下，如果它们打算在某些情况下在输出中包含HTML，那么转义它们会主动破坏内容。就像臭名昭著的管理员能够将HTML放入标题一样。

值得注意的是，HTML不能像面包屑一样逃离整个HTML块。违背了这一点。

你在本地化方面似乎还不错。

结束
标签： theme-development   escaping   小码农  

相关推荐

Disable escaping html

我在用SyntaxHighlighter Evolved 突出显示代码示例。E、 g。[csharp] string s = \"text\"; List<int> numbers = new List<int>(); [/csharp] 当我第一次保存它时，没关系，但编辑wordpress时，文本会更改为[csharp] string s = &quot;text&quot;; List&lt;int&am