diff --git a/mod/photos.php b/mod/photos.php
index 1b8d5069f8..b4ffb756c1 100644
--- a/mod/photos.php
+++ b/mod/photos.php
@@ -204,7 +204,7 @@ function photos_post(App $a)
}
// RENAME photo album
- $newalbum = Strings::escapeTags(trim($_POST['albumname']));
+ $newalbum = trim($_POST['albumname'] ?? '');
if ($newalbum != $album) {
Photo::update(['album' => $newalbum], ['album' => $album, 'uid' => $page_owner_uid]);
// Update the photo albums cache
diff --git a/mod/tagger.php b/mod/tagger.php
index af555790a5..d55e34f78b 100644
--- a/mod/tagger.php
+++ b/mod/tagger.php
@@ -32,7 +32,6 @@ use Friendica\Model\Item;
use Friendica\Model\Post;
use Friendica\Model\Tag;
use Friendica\Protocol\Activity;
-use Friendica\Util\Strings;
use Friendica\Util\XML;
use Friendica\Worker\Delivery;
@@ -42,15 +41,15 @@ function tagger_content(App $a) {
return;
}
- $term = Strings::escapeTags(trim($_GET['term']));
+ $term = trim($_GET['term'] ?? '');
// no commas allowed
- $term = str_replace([',',' '],['','_'],$term);
+ $term = str_replace([',',' ', '<', '>'],['','_', '', ''], $term);
if (!$term) {
return;
}
- $item_id = ((DI::args()->getArgc() > 1) ? Strings::escapeTags(trim(DI::args()->getArgv()[1])) : 0);
+ $item_id = ((DI::args()->getArgc() > 1) ? trim(DI::args()->getArgv()[1]) : 0);
Logger::notice('tagger: tag ' . $term . ' item ' . $item_id);
diff --git a/src/Module/BaseSearch.php b/src/Module/BaseSearch.php
index bccfc94de5..a3e7a8a8cc 100644
--- a/src/Module/BaseSearch.php
+++ b/src/Module/BaseSearch.php
@@ -48,7 +48,6 @@ class BaseSearch extends BaseModule
*/
public static function performContactSearch($search, $prefix = '')
{
- $a = DI::app();
$config = DI::config();
$type = Search::TYPE_ALL;
diff --git a/src/Module/Invite.php b/src/Module/Invite.php
index 566e54b129..65438c1514 100644
--- a/src/Module/Invite.php
+++ b/src/Module/Invite.php
@@ -58,7 +58,7 @@ class Invite extends BaseModule
$recipients = !empty($_POST['recipients']) ? explode("\n", $_POST['recipients']) : [];
- $message = !empty($_POST['message']) ? Strings::escapeTags(trim($_POST['message'])) : '';
+ $message = !empty($_POST['message']) ? Strings::escapeHtml(trim($_POST['message'])) : '';
$total = 0;
$invitation_only = false;
diff --git a/src/Module/Search/Directory.php b/src/Module/Search/Directory.php
index 6c898ecd0a..692122155f 100644
--- a/src/Module/Search/Directory.php
+++ b/src/Module/Search/Directory.php
@@ -25,7 +25,6 @@ use Friendica\Content\Widget;
use Friendica\DI;
use Friendica\Module\BaseSearch;
use Friendica\Module\Security\Login;
-use Friendica\Util\Strings;
/**
* Directory search module
@@ -39,7 +38,7 @@ class Directory extends BaseSearch
return Login::form();
}
- $search = Strings::escapeTags(trim(rawurldecode($_REQUEST['search'] ?? '')));
+ $search = trim(rawurldecode($_REQUEST['search'] ?? ''));
if (empty(DI::page()['aside'])) {
DI::page()['aside'] = '';
diff --git a/src/Module/Search/Index.php b/src/Module/Search/Index.php
index e9086cf587..769d5f90d2 100644
--- a/src/Module/Search/Index.php
+++ b/src/Module/Search/Index.php
@@ -38,13 +38,12 @@ use Friendica\Model\Post;
use Friendica\Model\Tag;
use Friendica\Module\BaseSearch;
use Friendica\Network\HTTPException;
-use Friendica\Util\Strings;
class Index extends BaseSearch
{
public static function content(array $parameters = [])
{
- $search = (!empty($_GET['q']) ? Strings::escapeTags(trim(rawurldecode($_GET['q']))) : '');
+ $search = (!empty($_GET['q']) ? trim(rawurldecode($_GET['q'])) : '');
if (DI::config()->get('system', 'block_public') && !Session::isAuthenticated()) {
throw new HTTPException\ForbiddenException(DI::l10n()->t('Public access denied.'));
@@ -88,7 +87,7 @@ class Index extends BaseSearch
$tag = false;
if (!empty($_GET['tag'])) {
$tag = true;
- $search = '#' . Strings::escapeTags(trim(rawurldecode($_GET['tag'])));
+ $search = '#' . trim(rawurldecode($_GET['tag']));
}
// contruct a wrapper for the search header
diff --git a/src/Module/Search/Saved.php b/src/Module/Search/Saved.php
index 723860bd80..d5cc15ceea 100644
--- a/src/Module/Search/Saved.php
+++ b/src/Module/Search/Saved.php
@@ -25,14 +25,13 @@ use Friendica\BaseModule;
use Friendica\Core\Search;
use Friendica\Database\DBA;
use Friendica\DI;
-use Friendica\Util\Strings;
class Saved extends BaseModule
{
public static function init(array $parameters = [])
{
$action = DI::args()->get(2, 'none');
- $search = Strings::escapeTags(trim(rawurldecode($_GET['term'] ?? '')));
+ $search = trim(rawurldecode($_GET['term'] ?? ''));
$return_url = $_GET['return_url'] ?? Search::getSearchPath($search);
diff --git a/src/Util/Strings.php b/src/Util/Strings.php
index 2f27e4a5ff..1be56d0e78 100644
--- a/src/Util/Strings.php
+++ b/src/Util/Strings.php
@@ -59,22 +59,6 @@ class Strings
return !empty($hexCode) ? @preg_match("/^[a-f0-9]{2,}$/i", $hexCode) && !(strlen($hexCode) & 1) : false;
}
- /**
- * This is our primary input filter.
- *
- * Use this on any text input where angle chars are not valid or permitted
- * They will be replaced with safer brackets. This may be filtered further
- * if these are not allowed either.
- *
- * @param string $string Input string
- * @return string Filtered string
- * @deprecated since 2020.09 Please use Smarty default HTML escaping for templates or htmlspecialchars() otherwise
- */
- public static function escapeTags($string)
- {
- return str_replace(["<", ">"], ['[', ']'], $string);
- }
-
/**
* Use this on "body" or "content" input where angle chars shouldn't be removed,
* and allow them to be safely displayed.
diff --git a/tests/src/Util/StringsTest.php b/tests/src/Util/StringsTest.php
index 5adaa9157a..7bfe9906b4 100644
--- a/tests/src/Util/StringsTest.php
+++ b/tests/src/Util/StringsTest.php
@@ -90,10 +90,8 @@ class StringsTest extends TestCase
{
$invalidstring='