--- loncom/localize/lonlocal.pm	2011/08/03 18:25:16	1.63
+++ loncom/localize/lonlocal.pm	2019/02/24 01:38:14	1.67
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Localization routines
 #
-# $Id: lonlocal.pm,v 1.63 2011/08/03 18:25:16 raeburn Exp $
+# $Id: lonlocal.pm,v 1.67 2019/02/24 01:38:14 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -38,7 +38,7 @@ Apache::lonlocal - provides localization
 
 lonlocal provides localization services for LON-CAPA programmers based
 on Locale::Maketext. See
-C<http://search.cpan.org/dist/Locale-Maketext/lib/Locale/Maketext.pod>
+C<https://metacpan.org/pod/Locale::Maketext>
 for more information on Maketext.
 
 =head1 OVERVIEWX<internationalization>
@@ -81,7 +81,7 @@ Inside might be something like this
      if ($status eq 'WON') {
         $message='You have won.';
      } elsif ($status eq 'LOST') {
-        $message='You are a total looser.';
+        $message='You are a total loser.';
      }
      return $message;
  }
@@ -103,7 +103,7 @@ The first two examples are easy:
      if ($status eq 'WON') {
         $message='You have won.';
      } elsif ($status eq 'LOST') {
-        $message='You are a total looser.';
+        $message='You are a total loser.';
      }
      return &mt($message);
  }
@@ -135,7 +135,7 @@ like this:
     'You have won.'
  => 'Sie haben gewonnen.',
 
-    'You are a total looser.'
+    'You are a total loser.'
  => 'Sie sind der totale Verlierer.',
 
     'Rules'
@@ -153,7 +153,7 @@ ignore the rest of the line.
 This is a relatively easy task, and any help is appreciated.
 
 Maketext can do a whole lot more, see
-C<http://search.cpan.org/dist/Locale-Maketext/lib/Locale/Maketext.pod>
+C<https://metacpan.org/pod/Locale::Maketext>
 but for most purposes, we do not have to mess with that.
 
 =cut
@@ -171,7 +171,7 @@ use DateTime::Locale;
 require Exporter;
 
 our @ISA = qw (Exporter);
-our @EXPORT = qw(mt mtn ns mt_user);
+our @EXPORT = qw(mt mtn ns mt_user js_escape html_escape);
 
 my %mtcache=();
 
@@ -325,7 +325,7 @@ sub current_locale {
 
 sub texthash {
     my %hash=@_;
-    foreach (keys %hash) {
+    foreach (keys(%hash)) {
 	$hash{$_}=&mt($hash{$_});
     }
     return %hash;
@@ -496,9 +496,11 @@ sub getdatelocale {
     return $locale_obj;
 }
 
-=pod 
+=pod
 
-=item * normalize_string
+=over 
+
+=item * normalize_string()
 
 Normalize string (reduce fragility in the lexicon files)
 
@@ -521,7 +523,7 @@ sub normalize_string {
 
 =pod 
 
-=item * ns
+=item * ns()
 
 alias for normalize_string; recommend using it only in the lexicon
 
@@ -533,7 +535,7 @@ sub ns {
 
 =pod
 
-=item * mtn
+=item * mtn()
 
 mtn: call the mt function and the normalization function easily.
 Returns original non-normalized string if there was no translation
@@ -562,7 +564,7 @@ sub transstatic {
 
 =pod 
 
-=item * mt_escape
+=item * mt_escape()
 
 mt_escape takes a string reference and escape the [] in there so mt
 will leave them as is and not try to expand them
@@ -575,13 +577,88 @@ sub mt_escape {
     $$str_ref =~s/([\[\]])/~$1/g;
 }
 
+=pod 
+
+=item * js_escape()
+
+js_escape takes a string, string reference or hash reference,
+and escapes the values so that they can be used within a <script> element.
+It replaces all instances of \ by \\, ' by \', " by \" and \n by \\n.
+It is typically used with localized strings, which might contain quotes.
+
+=cut
+
+sub js_escape {
+    my ($v) = @_;
+    my $ref = ref($v);
+    if ($ref eq 'SCALAR') {
+        $$v =~ s/\\/\\\\/g;
+        $$v =~ s/'/\\'/g;
+        $$v =~ s/"/\\"/g;
+        $$v =~ s/\n/\\n/g;
+    } elsif ($ref eq 'HASH') {
+        foreach my $key (keys %$v) {
+            $v->{$key} =~ s/\\/\\\\/g;
+            $v->{$key} =~ s/'/\\'/g;
+            $v->{$key} =~ s/"/\\"/g;
+            $v->{$key} =~ s/\n/\\n/g;
+        }
+    } else {
+        $v =~ s/\\/\\\\/g;
+        $v =~ s/'/\\'/g;
+        $v =~ s/"/\\"/g;
+        $v =~ s/\n/\\n/g;
+        return $v;
+    }
+}
+
+=pod 
+
+=item * html_escape()
+
+js_escape takes a string, string reference or hash reference,
+and escapes the values so that they can be used as HTML.
+It encodes <, >, &, ' and ".
+
+=cut
+
+sub html_escape {
+    my ($v) = @_;
+    my $ref = ref($v);
+    if ($ref eq 'SCALAR') {
+        $$v =~ s/&/&amp;/g;
+        $$v =~ s/</&lt;/g;
+        $$v =~ s/>/&gt;/g;
+        $$v =~ s/'/&apos;/g;
+        $$v =~ s/"/&quot;/g;
+    } elsif ($ref eq 'HASH') {
+        foreach my $key (keys %$v) {
+            $v->{$key} =~ s/&/&amp;/g;
+            $v->{$key} =~ s/</&lt;/g;
+            $v->{$key} =~ s/>/&gt;/g;
+            $v->{$key} =~ s/'/&apos;/g;
+            $v->{$key} =~ s/"/&quot;/g;
+        }
+    } else {
+        $v =~ s/&/&amp;/g;
+        $v =~ s/</&lt;/g;
+        $v =~ s/>/&gt;/g;
+        $v =~ s/'/&apos;/g;
+        $v =~ s/"/&quot;/g;
+        return $v;
+    }
+    # NOTE: we could also turn \n into <br> if needed
+}
+
 =pod
 
-=item * choose_language
+=item * choose_language()
 
 choose_language prompts a user to enter a two letter language code via
 keyboard when running a script from the command line. Default is en.
 
+=back
+
 =cut
 
 sub choose_language {