--- loncom/localize/lonlocal.pm	2011/08/03 18:25:16	1.63
+++ loncom/localize/lonlocal.pm	2015/06/09 21:23:15	1.66
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Localization routines
 #
-# $Id: lonlocal.pm,v 1.63 2011/08/03 18:25:16 raeburn Exp $
+# $Id: lonlocal.pm,v 1.66 2015/06/09 21:23:15 damieng Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -81,7 +81,7 @@ Inside might be something like this
      if ($status eq 'WON') {
         $message='You have won.';
      } elsif ($status eq 'LOST') {
-        $message='You are a total looser.';
+        $message='You are a total loser.';
      }
      return $message;
  }
@@ -103,7 +103,7 @@ The first two examples are easy:
      if ($status eq 'WON') {
         $message='You have won.';
      } elsif ($status eq 'LOST') {
-        $message='You are a total looser.';
+        $message='You are a total loser.';
      }
      return &mt($message);
  }
@@ -135,7 +135,7 @@ like this:
     'You have won.'
  => 'Sie haben gewonnen.',
 
-    'You are a total looser.'
+    'You are a total loser.'
  => 'Sie sind der totale Verlierer.',
 
     'Rules'
@@ -171,7 +171,7 @@ use DateTime::Locale;
 require Exporter;
 
 our @ISA = qw (Exporter);
-our @EXPORT = qw(mt mtn ns mt_user);
+our @EXPORT = qw(mt mtn ns mt_user js_escape html_escape);
 
 my %mtcache=();
 
@@ -325,7 +325,7 @@ sub current_locale {
 
 sub texthash {
     my %hash=@_;
-    foreach (keys %hash) {
+    foreach (keys(%hash)) {
 	$hash{$_}=&mt($hash{$_});
     }
     return %hash;
@@ -575,6 +575,79 @@ sub mt_escape {
     $$str_ref =~s/([\[\]])/~$1/g;
 }
 
+=pod 
+
+=item * js_escape
+
+js_escape takes a string, string reference or hash reference,
+and escapes the values so that they can be used within a <script> element.
+It replaces all instances of \ by \\, ' by \', " by \" and \n by \\n.
+It is typically used with localized strings, which might contain quotes.
+
+=cut
+
+sub js_escape {
+    my ($v) = @_;
+    my $ref = ref($v);
+    if ($ref eq 'SCALAR') {
+        $$v =~ s/\\/\\\\/g;
+        $$v =~ s/'/\\'/g;
+        $$v =~ s/"/\\"/g;
+        $$v =~ s/\n/\\n/g;
+    } elsif ($ref eq 'HASH') {
+        foreach my $key (keys %$v) {
+            $v->{$key} =~ s/\\/\\\\/g;
+            $v->{$key} =~ s/'/\\'/g;
+            $v->{$key} =~ s/"/\\"/g;
+            $v->{$key} =~ s/\n/\\n/g;
+        }
+    } else {
+        $v =~ s/\\/\\\\/g;
+        $v =~ s/'/\\'/g;
+        $v =~ s/"/\\"/g;
+        $v =~ s/\n/\\n/g;
+        return $v;
+    }
+}
+
+=pod 
+
+=item * html_escape
+
+js_escape takes a string, string reference or hash reference,
+and escapes the values so that they can be used as HTML.
+It encodes <, >, &, ' and ".
+
+=cut
+
+sub html_escape {
+    my ($v) = @_;
+    my $ref = ref($v);
+    if ($ref eq 'SCALAR') {
+        $$v =~ s/&/&amp;/g;
+        $$v =~ s/</&lt;/g;
+        $$v =~ s/>/&gt;/g;
+        $$v =~ s/'/&apos;/g;
+        $$v =~ s/"/&quot;/g;
+    } elsif ($ref eq 'HASH') {
+        foreach my $key (keys %$v) {
+            $v->{$key} =~ s/&/&amp;/g;
+            $v->{$key} =~ s/</&lt;/g;
+            $v->{$key} =~ s/>/&gt;/g;
+            $v->{$key} =~ s/'/&apos;/g;
+            $v->{$key} =~ s/"/&quot;/g;
+        }
+    } else {
+        $v =~ s/&/&amp;/g;
+        $v =~ s/</&lt;/g;
+        $v =~ s/>/&gt;/g;
+        $v =~ s/'/&apos;/g;
+        $v =~ s/"/&quot;/g;
+        return $v;
+    }
+    # NOTE: we could also turn \n into <br> if needed
+}
+
 =pod
 
 =item * choose_language