adding a value in createElement doesn't care for escaping but createTextNode does...

diff --git a/include/cbsm/util/document.php-class b/include/cbsm/util/document.php-class
index fa269ca77d50b6d5352b49847af84389eeb2506e..6a36dfc704987e24c8bb5ea5bb9b120cd12c0b03 100755 (executable)
--- a/include/cbsm/util/document.php-class
+++ b/include/cbsm/util/document.php-class
@@ -187,7 +187,10 @@ class ExtendedDocument extends DOMDocument {
   }
 
   function appendElement($name, $value = '') {
   }
 
   function appendElement($name, $value = '') {

-    return $this->appendChild($this->createElement($name, $value));
+    // Adding the $value in createElement does NOT escape it, so use appendText to support that.
+    $aelem = $this->appendChild($this->createElement($name));
+    $aelem->appendText($value);
+    return $aelem;

   }
   function appendElementXML($name, $xmldata) {
     $aelem = $this->appendChild($this->createElement($name));
   }
   function appendElementXML($name, $xmldata) {
     $aelem = $this->appendChild($this->createElement($name));


@@ -270,7 +273,8 @@ class ExtendedDocument extends DOMDocument {
   }
 
   function createElementLink($target, $value = '') {
   }
 
   function createElementLink($target, $value = '') {

-    $link = $this->createElement('a', $value);
+    $link = $this->createElement('a');
+    $link->appendText($value);

     $link->setAttribute('href', $target); // XXX: take care of & etc. in links
     return $link;
   }
     $link->setAttribute('href', $target); // XXX: take care of & etc. in links
     return $link;
   }


@@ -499,7 +503,10 @@ class ExtendedElement extends DOMElement {
   //     returns the new child
 
   function appendElement($name, $value = '') {
   //     returns the new child
 
   function appendElement($name, $value = '') {

-    return $this->appendChild($this->ownerDocument->createElement($name, $value));
+    // Adding the $value in createElement does NOT escape it, so use appendText to support that.
+    $aelem = $this->appendChild($this->ownerDocument->createElement($name));
+    $aelem->appendText($value);
+    return $aelem;

   }
   function appendElementXML($name, $xmldata) {
     $aelem = $this->appendChild($this->ownerDocument->createElement($name));
   }
   function appendElementXML($name, $xmldata) {
     $aelem = $this->appendChild($this->ownerDocument->createElement($name));


@@ -663,7 +670,10 @@ class ExtendedDocumentFragment extends DOMDocumentFragment {
   //     returns the new child
 
   function appendElement($name, $value = '') {
   //     returns the new child
 
   function appendElement($name, $value = '') {

-    return $this->appendChild($this->ownerDocument->createElement($name, $value));
+    // Adding the $value in createElement does NOT escape it, so use appendText to support that.
+    $aelem = $this->appendChild($this->ownerDocument->createElement($name));
+    $aelem->appendText($value);
+    return $aelem;

   }
   function appendElementXML($name, $xmldata) {
     $aelem = $this->appendChild($this->ownerDocument->createElement($name));
   }
   function appendElementXML($name, $xmldata) {
     $aelem = $this->appendChild($this->ownerDocument->createElement($name));