N°4517 - PHP 8.1: Replace htmlentities(***, ENT_QUOTES, 'UTF-8') with utils::EscapeHtml

2026-05-01 22:48:45 +02:00 · 2022-07-01 09:22:25 +02:00
parent 139be3a9b7
commit 7ec12f1e12
54 changed files with 446 additions and 589 deletions
--- a/setup/wizardsteps.class.inc.php
+++ b/setup/wizardsteps.class.inc.php
@@ -304,13 +304,10 @@ HTML
 		$sChecked = ($bCanBackup && $bDBBackup) ? ' checked ' : '';
 		$sDisabled = $bCanBackup ? '' : ' disabled ';
 		$oPage->add('<input id="db_backup" type="checkbox" name="db_backup" '.$sChecked.$sDisabled.' value="1"/><label for="db_backup">Backup the '.ITOP_APPLICATION.' database before upgrading</label>');
-		$oPage->add('<div class="setup-backup--input--container">Save the backup to:<input id="db_backup_path" class="ibo-input" type="text" name="db_backup_path" 
-'.$sDisabled.'value="'
-			.htmlentities($sDBBackupPath, ENT_QUOTES, 'UTF-8').'"/></div>');
+		$oPage->add('<div class="setup-backup--input--container">Save the backup to:<input id="db_backup_path" class="ibo-input" type="text" name="db_backup_path" '.$sDisabled.'value="'.utils::EscapeHtml($sDBBackupPath).'"/></div>');
 		$fFreeSpace = SetupUtils::CheckDiskSpace($sDBBackupPath);
 		$sMessage = '';
-		if ($fFreeSpace !== false)
-		{
+		if ($fFreeSpace !== false) {
 			$sMessage .= SetupUtils::HumanReadableSize($fFreeSpace).' free in '.dirname($sDBBackupPath);
 		}
 		$oPage->add($sMySQLDumpMessage.'<span id="backup_info" style="font-size:small;color:#696969;">'.$sMessage.'</span>');
@@ -332,17 +329,16 @@ JS
 		switch($sCode)
 		{
 			case 'check_path':
-			$sPreviousVersionDir = $aParameters['previous_version_dir'];
-			$aPreviousInstance = SetupUtils::GetPreviousInstance($sPreviousVersionDir);
-			if ($aPreviousInstance['found'])
-			{
-				$sDBServer = htmlentities($aPreviousInstance['db_server'], ENT_QUOTES, 'UTF-8');
-				$sDBUser = htmlentities($aPreviousInstance['db_user'], ENT_QUOTES, 'UTF-8');
-				$sDBPwd = htmlentities($aPreviousInstance['db_pwd'], ENT_QUOTES, 'UTF-8');
-				$sDBName = htmlentities($aPreviousInstance['db_name'], ENT_QUOTES, 'UTF-8');
-				$sDBPrefix = htmlentities($aPreviousInstance['db_prefix'], ENT_QUOTES, 'UTF-8');
-				$oPage->add_ready_script(
-<<<EOF
+				$sPreviousVersionDir = $aParameters['previous_version_dir'];
+				$aPreviousInstance = SetupUtils::GetPreviousInstance($sPreviousVersionDir);
+				if ($aPreviousInstance['found']) {
+					$sDBServer = utils::EscapeHtml($aPreviousInstance['db_server']);
+					$sDBUser = utils::EscapeHtml($aPreviousInstance['db_user']);
+					$sDBPwd = utils::EscapeHtml($aPreviousInstance['db_pwd']);
+					$sDBName = utils::EscapeHtml($aPreviousInstance['db_name']);
+					$sDBPrefix = utils::EscapeHtml($aPreviousInstance['db_prefix']);
+					$oPage->add_ready_script(
+						<<<EOF
 	$("#db_server").val('$sDBServer');
 	$("#db_user").val('$sDBUser');
 	$("#db_pwd").val('$sDBPwd');
@@ -350,7 +346,7 @@ JS
 	$("#db_prefix").val('$sDBPrefix');
 	$("#db_pwd").trigger('change'); // Forces check of the DB connection
 EOF
-				);
+					);
 			}
 			break;

@@ -359,21 +355,18 @@ EOF
 			break;

 			case 'check_backup':
-			$sDBBackupPath = $aParameters['db_backup_path'];
-			$fFreeSpace = SetupUtils::CheckDiskSpace($sDBBackupPath);
-			if ($fFreeSpace !== false)
-			{
-				$sMessage = htmlentities(SetupUtils::HumanReadableSize($fFreeSpace).' free in '.dirname($sDBBackupPath), ENT_QUOTES, 'UTF-8');
-				$oPage->add_ready_script(
-<<<EOF
+				$sDBBackupPath = $aParameters['db_backup_path'];
+				$fFreeSpace = SetupUtils::CheckDiskSpace($sDBBackupPath);
+				if ($fFreeSpace !== false) {
+					$sMessage = utils::EscapeHtml(SetupUtils::HumanReadableSize($fFreeSpace).' free in '.dirname($sDBBackupPath));
+					$oPage->add_ready_script(
+						<<<EOF
 	$("#backup_info").html('$sMessage');
 EOF
-				);
-			}
-			else
-			{
-				$oPage->add_ready_script(
-<<<EOF
+					);
+				} else {
+					$oPage->add_ready_script(
+						<<<EOF
 	$("#backup_info").html('');
 EOF
 				);
@@ -547,8 +540,7 @@ EOF
 				// Check if the previous version is a "genuine" one or not...
 				$aChanges = SetupUtils::CheckVersion($sInstalledDataModelVersion, $sPreviousVersionDir.'/'.$sPreviousSourceDir);
 			}
-			if (($aChanges !== false) && ( (count($aChanges['added']) > 0) || (count($aChanges['removed']) > 0) || (count($aChanges['modified']) > 0)) )
-			{
+			if (($aChanges !== false) && ( (count($aChanges['added']) > 0) || (count($aChanges['removed']) > 0) || (count($aChanges['modified']) > 0)) ) {
 				// Some changes were detected, prompt the user to keep or discard them
 				$oPage->p("<img src=\"../images/error.png\"/>&nbsp;Some modifications were detected between the ".ITOP_APPLICATION." version in '$sPreviousVersionDir' and a genuine $sInstalledVersion version.");
 				$oPage->p("What do you want to do?");
@@ -558,41 +550,36 @@ EOF
 				$sChecked = ($this->oWizard->GetParameter('upgrade_type') == 'keep-previous') ? ' checked ' : '';
 				$sDisabled = (count($aErrors) > 0) ? ' disabled ' : '';

-                $oPage->p('<input id="radio_upgrade_keep" type="radio" name="upgrade_type" value="keep-previous" '.$sChecked.$sDisabled.'/><label for="radio_upgrade_keep">&nbsp;Preserve the modifications of the installed version (the dasboards inside '.ITOP_APPLICATION.' may not be editable).</label>');
-				$oPage->add('<input type="hidden" name="datamodel_previous_version" value="'.htmlentities($sInstalledDataModelVersion, ENT_QUOTES, 'UTF-8').'">');
+				$oPage->p('<input id="radio_upgrade_keep" type="radio" name="upgrade_type" value="keep-previous" '.$sChecked.$sDisabled.'/><label for="radio_upgrade_keep">&nbsp;Preserve the modifications of the installed version (the dasboards inside '.ITOP_APPLICATION.' may not be editable).</label>');
+				$oPage->add('<input type="hidden" name="datamodel_previous_version" value="'.utils::EscapeHtml($sInstalledDataModelVersion).'">');

-				$oPage->add('<input type="hidden" name="relative_source_dir" value="'.htmlentities($sPreviousSourceDir, ENT_QUOTES, 'UTF-8').'">');
+				$oPage->add('<input type="hidden" name="relative_source_dir" value="'.utils::EscapeHtml($sPreviousSourceDir).'">');

-				if (count($aErrors) > 0)
-				{
+				if (count($aErrors) > 0) {
 					$oPage->p("Cannot copy the installed version due to the following access rights issue(s):");
-					foreach($aErrors as $sDir => $oCheckResult)
-					{
+					foreach ($aErrors as $sDir => $oCheckResult) {
 						$oPage->p('<img src="../images/error.png"/>&nbsp;'.$oCheckResult->sLabel);
 					}
 				}

 				$sChecked = ($this->oWizard->GetParameter('upgrade_type') == 'use-compatible') ? ' checked ' : '';

-                $oPage->p('<input id="radio_upgrade_convert" type="radio" name="upgrade_type" value="use-compatible" '.$sChecked.'/><label for="radio_upgrade_convert">&nbsp;Discard the modifications, use a standard '.$sUpgradeDMVersion.' data model.</label>');
+				$oPage->p('<input id="radio_upgrade_convert" type="radio" name="upgrade_type" value="use-compatible" '.$sChecked.'/><label for="radio_upgrade_convert">&nbsp;Discard the modifications, use a standard '.$sUpgradeDMVersion.' data model.</label>');

-				$oPage->add('<input type="hidden" name="datamodel_path" value="'.htmlentities($sCompatibleDMDir, ENT_QUOTES, 'UTF-8').'">');
-				$oPage->add('<input type="hidden" name="datamodel_version" value="'.htmlentities($sUpgradeDMVersion, ENT_QUOTES, 'UTF-8').'">');
+				$oPage->add('<input type="hidden" name="datamodel_path" value="'.utils::EscapeHtml($sCompatibleDMDir).'">');
+				$oPage->add('<input type="hidden" name="datamodel_version" value="'.utils::EscapeHtml($sUpgradeDMVersion).'">');

 				$oPage->add('<div id="changes_summary"><div class="closed"><span class="title">Details of the modifications</span><div>');
-				if (count($aChanges['added']) > 0)
-				{
+				if (count($aChanges['added']) > 0) {
 					$oPage->add('<ul>New files added:');
-					foreach($aChanges['added'] as $sFilePath => $void)
-					{
+					foreach ($aChanges['added'] as $sFilePath => $void) {
 						$oPage->add('<li>'.$sFilePath.'</li>');
 					}
 					$oPage->add('</ul>');
 				}
-				if (count($aChanges['removed']) > 0)
-				{
+				if (count($aChanges['removed']) > 0) {
 					$oPage->add('<ul>Deleted files:');
-					foreach($aChanges['removed'] as $sFilePath => $void)
+					foreach ($aChanges['removed'] as $sFilePath => $void)
 					{
 						$oPage->add('<li>'.$sFilePath.'</li>');
 					}
@@ -917,9 +904,9 @@ class WizStepAdminAccount extends WizardStep
 		$oPage->add('<fieldset>');
 		$oPage->add('<legend>Administrator Account</legend>');
 		$oPage->add('<table>');
-		$oPage->add('<tr><td>Login: </td><td><input id="admin_user" class="ibo-input" name="admin_user" type="text" size="25" maxlength="64" value="'.htmlentities($sAdminUser, ENT_QUOTES, 'UTF-8').'"><span id="v_admin_user"/></td></tr>');
-		$oPage->add('<tr><td>Password: </td><td><input id="admin_pwd" class="ibo-input"  autocomplete="off" name="admin_pwd" type="password" size="25" maxlength="64" value="'.htmlentities($sAdminPwd, ENT_QUOTES, 'UTF-8').'"><span id="v_admin_pwd"/></td></tr>');
-		$oPage->add('<tr><td>Confirm password: </td><td><input id="confirm_pwd" class="ibo-input"  autocomplete="off" name="confirm_pwd" type="password" size="25" maxlength="64" value="'.htmlentities($sConfirmPwd, ENT_QUOTES, 'UTF-8').'"></td></tr>');
+		$oPage->add('<tr><td>Login: </td><td><input id="admin_user" class="ibo-input" name="admin_user" type="text" size="25" maxlength="64" value="'.utils::EscapeHtml($sAdminUser).'"><span id="v_admin_user"/></td></tr>');
+		$oPage->add('<tr><td>Password: </td><td><input id="admin_pwd" class="ibo-input"  autocomplete="off" name="admin_pwd" type="password" size="25" maxlength="64" value="'.utils::EscapeHtml($sAdminPwd).'"><span id="v_admin_pwd"/></td></tr>');
+		$oPage->add('<tr><td>Confirm password: </td><td><input id="confirm_pwd" class="ibo-input"  autocomplete="off" name="confirm_pwd" type="password" size="25" maxlength="64" value="'.utils::EscapeHtml($sConfirmPwd).'"></td></tr>');
 		$sSourceDir = APPROOT.'dictionaries/';
 		$aLanguages = SetupUtils::GetAvailableLanguages($sSourceDir);
 		$oPage->add('<tr><td>Language: </td><td>');
@@ -928,7 +915,7 @@ class WizStepAdminAccount extends WizardStep
 		$oPage->add('</table>');
 		$oPage->add('</fieldset>');
 		$oPage->add_ready_script(
-<<<EOF
+			<<<EOF
 		$('#admin_user').bind('change keyup', function() { WizardUpdateButtons(); } );
 		$('#admin_pwd').bind('change keyup', function() { WizardUpdateButtons(); } );
 		$('#confirm_pwd').bind('change keyup', function() { WizardUpdateButtons(); } );
@@ -1049,29 +1036,29 @@ class WizStepInstallMiscParams extends AbstractWizStepMiscParams
 		$oPage->add('<fieldset>');
 		$oPage->add('<legend>Application URL</legend>');
 		$oPage->add('<table>');
-		$oPage->add('<tr><td>URL: </td><td><input id="application_url" class="ibo-input" name="application_url" type="text" size="35" maxlength="1024" value="'.htmlentities($sApplicationURL, ENT_QUOTES, 'UTF-8').'" style="width: 100%;box-sizing: border-box;"><span id="v_application_url"/></td><tr>');
+		$oPage->add('<tr><td>URL: </td><td><input id="application_url" class="ibo-input" name="application_url" type="text" size="35" maxlength="1024" value="'.utils::EscapeHtml($sApplicationURL).'" style="width: 100%;box-sizing: border-box;"><span id="v_application_url"/></td><tr>');
 		$oPage->add('</table>');
 		$oPage->add('<div class="message message-warning">Change the value above if the end-users will be accessing the application by another path due to a specific configuration of the web server.</div>');
 		$oPage->add('</fieldset>');
 		$oPage->add('<fieldset>');
 		$oPage->add('<legend>Path to Graphviz\' dot application</legend>');
 		$oPage->add('<table>');
-		$oPage->add('<tr><td>Path: </td><td><input id="graphviz_path" class="ibo-input" name="graphviz_path" type="text" size="35" maxlength="1024" value="'.htmlentities($sGraphvizPath, ENT_QUOTES, 'UTF-8').'" style="width: 100%;box-sizing: border-box;"><span id="v_graphviz_path"/></td>');
+		$oPage->add('<tr><td>Path: </td><td><input id="graphviz_path" class="ibo-input" name="graphviz_path" type="text" size="35" maxlength="1024" value="'.utils::EscapeHtml($sGraphvizPath).'" style="width: 100%;box-sizing: border-box;"><span id="v_graphviz_path"/></td>');
 		$oPage->add('<td><i class="fas fa-question-circle setup-input--hint--icon" data-tooltip-content="Graphviz is required to display the impact analysis graph (i.e. impacts / depends on)."></i></td><tr>');
 		$oPage->add('</table>');
 		$oPage->add('<span id="graphviz_status"></span>');
 		$oPage->add('</fieldset>');
 		$oPage->add('<fieldset>');
 		$oPage->add('<legend>Sample Data</legend>');
-        $sChecked = ($sSampleData == 'yes') ? 'checked ' : '';
-        $oPage->p('<input id="sample_data_yes" name="sample_data" type="radio" value="yes" '.$sChecked.'><label for="sample_data_yes">&nbsp;I am installing a <b>demo or test</b> instance, populate the database with some demo data.');
-        $sChecked = ($sSampleData == 'no') ? 'checked ' : '';
-        $oPage->p('<input id="sample_data_no" name="sample_data" type="radio" value="no" '.$sChecked.'><label for="sample_data_no">&nbsp;I am installing a <b>production</b> instance, create an empty database to start from.');
+		$sChecked = ($sSampleData == 'yes') ? 'checked ' : '';
+		$oPage->p('<input id="sample_data_yes" name="sample_data" type="radio" value="yes" '.$sChecked.'><label for="sample_data_yes">&nbsp;I am installing a <b>demo or test</b> instance, populate the database with some demo data.');
+		$sChecked = ($sSampleData == 'no') ? 'checked ' : '';
+		$oPage->p('<input id="sample_data_no" name="sample_data" type="radio" value="no" '.$sChecked.'><label for="sample_data_no">&nbsp;I am installing a <b>production</b> instance, create an empty database to start from.');
 		$oPage->add('</fieldset>');
 		$sAuthentToken = $this->oWizard->GetParameter('authent', '');
 		$oPage->add('<input type="hidden" id="authent_token" value="'.$sAuthentToken.'"/>');
 		$oPage->add_ready_script(
-<<<EOF
+			<<<EOF
 		$('#application_url').bind('change keyup', function() { WizardUpdateButtons(); } );
 		$('#graphviz_path').bind('change keyup init', function() { WizardUpdateButtons();  WizardAsyncAction('check_graphviz', { graphviz_path: $('#graphviz_path').val(), authent: $('#authent_token').val()}); } ).trigger('init');
 		$('#btn_next').on('click', function() {
@@ -1197,14 +1184,14 @@ class WizStepUpgradeMiscParams extends AbstractWizStepMiscParams
 		$oPage->add('<fieldset>');
 		$oPage->add('<legend>Application URL</legend>');
 		$oPage->add('<table>');
-		$oPage->add('<tr><td>URL: </td><td><input id="application_url" class="ibo-input" name="application_url" type="text" size="35" maxlength="1024" value="'.htmlentities($sApplicationURL, ENT_QUOTES, 'UTF-8').'" style="width: 100%;box-sizing: border-box;"><span id="v_application_url"/></td><tr>');
+		$oPage->add('<tr><td>URL: </td><td><input id="application_url" class="ibo-input" name="application_url" type="text" size="35" maxlength="1024" value="'.utils::EscapeHtml($sApplicationURL).'" style="width: 100%;box-sizing: border-box;"><span id="v_application_url"/></td><tr>');
 		$oPage->add('</table>');
 		$oPage->add('<div class="message message-warning">Change the value above if the end-users will be accessing the application by another path due to a specific configuration of the web server.</div>');
 		$oPage->add('</fieldset>');
 		$oPage->add('<fieldset>');
 		$oPage->add('<legend>Path to Graphviz\' dot application</legend>');
 		$oPage->add('<table>');
-		$oPage->add('<tr><td>Path: </td><td><input id="graphviz_path" class="ibo-input" name="graphviz_path" type="text" size="35" maxlength="1024" value="'.htmlentities($sGraphvizPath, ENT_QUOTES, 'UTF-8').'" style="width: 100%;box-sizing: border-box;"><span id="v_graphviz_path"/></td>');
+		$oPage->add('<tr><td>Path: </td><td><input id="graphviz_path" class="ibo-input" name="graphviz_path" type="text" size="35" maxlength="1024" value="'.utils::EscapeHtml($sGraphvizPath).'" style="width: 100%;box-sizing: border-box;"><span id="v_graphviz_path"/></td>');
 		$oPage->add('<td><i class="fas fa-question-circle setup-input--hint--icon" data-tooltip-content="Graphviz is required to display the impact analysis graph (i.e. impacts / depends on)."></i></td><tr>');
 		$oPage->add('</table>');
 		$oPage->add('<span id="graphviz_status"></span>');
@@ -1212,7 +1199,7 @@ class WizStepUpgradeMiscParams extends AbstractWizStepMiscParams
 		$sAuthentToken = $this->oWizard->GetParameter('authent', '');
 		$oPage->add('<input type="hidden" id="authent_token" value="'.$sAuthentToken.'"/>');
 		$oPage->add_ready_script(
-<<<EOF
+			<<<EOF
 		$('#application_url').bind('change keyup', function() { WizardUpdateButtons(); } );
 		$('#graphviz_path').bind('change keyup init', function() { WizardUpdateButtons();  WizardAsyncAction('check_graphviz', { graphviz_path: $('#graphviz_path').val(), authent: $('#authent_token').val() }); } ).trigger('init');
 		$('#btn_next').on('click', function() {
@@ -2024,32 +2011,25 @@ EOF
 		$index = 0;

 		$sAllDisabled = '';
-		if ($bAllDisabled)
-		{
+		if ($bAllDisabled) {
 			$sAllDisabled = 'disabled data-disabled="disabled" ';
 		}

-		foreach($aOptions as $index => $aChoice)
-		{
+		foreach ($aOptions as $index => $aChoice) {
 			$sAttributes = '';
 			$sChoiceId = $sParentId.self::$SEP.$index;
-			$sDataId = 'data-id="'.htmlentities($aChoice['extension_code'], ENT_QUOTES, 'UTF-8').'"';
-			$sId = htmlentities($aChoice['extension_code'], ENT_QUOTES, 'UTF-8');
+			$sDataId = 'data-id="'.utils::EscapeHtml($aChoice['extension_code']).'"';
+			$sId = utils::EscapeHtml($aChoice['extension_code']);
 			$bIsDefault = array_key_exists($sChoiceId, $aDefaults);
 			$bSelected = isset($aSelectedComponents[$sChoiceId]) && ($aSelectedComponents[$sChoiceId] == $sChoiceId);
 			$bMandatory = (isset($aChoice['mandatory']) && $aChoice['mandatory']) || ($this->bUpgrade && $bIsDefault);
 			$bDisabled = false;
-			if ($bMandatory)
-			{
+			if ($bMandatory) {
 				$oPage->add('<div class="choice" '.$sDataId.'><input id="'.$sId.'" checked disabled data-disabled="disabled" type="checkbox"'.$sAttributes.'/><input type="hidden" name="choice['.$sChoiceId.']" value="'.$sChoiceId.'">&nbsp;');
 				$bDisabled = true;
-			}
-			else if ($bSelected)
-			{
+			} else if ($bSelected) {
 				$oPage->add('<div class="choice" '.$sDataId.'><input class="wiz-choice" '.$sAllDisabled.'id="'.$sId.'" name="choice['.$sChoiceId.']" type="checkbox" checked value="'.$sChoiceId.'"/>&nbsp;');
-			}
-			else
-			{
+			} else {
 				$oPage->add('<div class="choice" '.$sDataId.'><input class="wiz-choice" '.$sAllDisabled.'id="'.$sId.'" name="choice['.$sChoiceId.']" type="checkbox" value="'.$sChoiceId.'"/>&nbsp;');
 			}
 			$this->DisplayChoice($oPage, $aChoice, $aSelectedComponents, $aDefaults, $sChoiceId, $bDisabled);
@@ -2081,35 +2061,30 @@ EOF
 			}
 		}

-		if (!array_key_exists($sChoiceName, $aDefaults) || ($aDefaults[$sChoiceName] == $sChoiceIdNone))
-		{
+		if (!array_key_exists($sChoiceName, $aDefaults) || ($aDefaults[$sChoiceName] == $sChoiceIdNone)) {
 			// The "none" choice does not disable the selection !!
 			$sDisabled = '';
 			$bDisabled = false;
 		}

-		foreach($aAlternatives as $index => $aChoice)
-		{
+		foreach ($aAlternatives as $index => $aChoice) {
 			$sAttributes = '';
 			$sChoiceId = $sParentId.self::$SEP.$index;
-			$sDataId = 'data-id="'.htmlentities($aChoice['extension_code'], ENT_QUOTES, 'UTF-8').'"';
-			$sId = htmlentities($aChoice['extension_code'], ENT_QUOTES, 'UTF-8');
+			$sDataId = 'data-id="'.utils::EscapeHtml($aChoice['extension_code']).'"';
+			$sId = utils::EscapeHtml($aChoice['extension_code']);

-			if ($sChoiceName == null)
-			{
+			if ($sChoiceName == null) {
 				$sChoiceName = $sChoiceId; // All radios share the same name
 			}
 			$bIsDefault = array_key_exists($sChoiceName, $aDefaults) && ($aDefaults[$sChoiceName] == $sChoiceId);
 			$bSelected = isset($aSelectedComponents[$sChoiceName]) && ($aSelectedComponents[$sChoiceName] == $sChoiceId);
-			if ( !isset($aSelectedComponents[$sChoiceName]) && ($sChoiceIdNone != null))
-			{
+			if (!isset($aSelectedComponents[$sChoiceName]) && ($sChoiceIdNone != null)) {
 				// No choice selected, select the "None" option
 				$bSelected = ($sChoiceId == $sChoiceIdNone);
 			}
 			$bMandatory = (isset($aChoice['mandatory']) && $aChoice['mandatory']) || ($this->bUpgrade && $bIsDefault);

-			if ($bSelected)
-			{
+			if ($bSelected) {
 				$sAttributes = ' checked ';
 			}
 			$sHidden = '';
@@ -2129,12 +2104,11 @@ EOF
 	{
 		$sMoreInfo = (isset($aChoice['more_info']) && ($aChoice['more_info'] != '')) ? '<a class="setup--wizard-choice--more-info" target="_blank" href="'.$aChoice['more_info'].'">More information</a>' : '';
 		$sSourceLabel = isset($aChoice['source_label']) ? $aChoice['source_label'] : '';
-		$sId = htmlentities($aChoice['extension_code'], ENT_QUOTES, 'UTF-8');
-		$oPage->add('<label class="setup--wizard-choice--label" for="'.$sId.'">'.$sSourceLabel.'<b>'.htmlentities($aChoice['title'], ENT_QUOTES, 'UTF-8').'</b>'.'</label> '.$sMoreInfo);
-		$sDescription = isset($aChoice['description']) ? htmlentities($aChoice['description'], ENT_QUOTES, 'UTF-8') : '';
+		$sId = utils::EscapeHtml($aChoice['extension_code']);
+		$oPage->add('<label class="setup--wizard-choice--label" for="'.$sId.'">'.$sSourceLabel.'<b>'.utils::EscapeHtml($aChoice['title']).'</b>'.'</label> '.$sMoreInfo);
+		$sDescription = isset($aChoice['description']) ? utils::EscapeHtml($aChoice['description']) : '';
 		$oPage->add('<div class="setup--wizard-choice--description description">'.$sDescription.'<span id="sub_choices'.$sId.'">');
-		if (isset($aChoice['sub_options']))
-		{
+		if (isset($aChoice['sub_options'])) {
 			$this->DisplayOptions($oPage, $aChoice['sub_options'], $aSelectedComponents, $aDefaults, $sChoiceId, $bDisabled);
 		}
 		$oPage->add('</span></div>');
@@ -2295,8 +2269,7 @@ class WizStepSummary extends WizardStep
 		if (count($aMiscOptions) > 0)
 		{
 			$oPage->add('<div class="closed"><span class="title">Miscellaneous Options</span><ul>');
-			foreach($aMiscOptions as $sKey => $sValue)
-			{
+			foreach ($aMiscOptions as $sKey => $sValue) {
 				$oPage->add('<li>'.$sKey.': '.$sValue.'</li>');
 			}
 			$oPage->add('</ul></div>');
@@ -2305,8 +2278,7 @@ class WizStepSummary extends WizardStep

 		$aSelectedModules = $aInstallParams['selected_modules'];

-		if (isset($aMiscOptions['generate_config']))
-		{
+		if (isset($aMiscOptions['generate_config'])) {
 			$oDoc = new DOMDocument('1.0', 'UTF-8');
 			$oDoc->preserveWhiteSpace = false;
 			$oDoc->formatOutput = true;
@@ -2315,7 +2287,7 @@ class WizStepSummary extends WizardStep
 			$oParams->ToXML($oDoc, null, 'installation');
 			$sXML = $oDoc->saveXML();
 			$oPage->add('<div class="closed"><span class="title">XML Config file</span><ul><pre>');
-			$oPage->add(htmlentities($sXML, ENT_QUOTES, 'UTF-8'));
+			$oPage->add(utils::EscapeHtml($sXML));
 			$oPage->add('</pre></ul></div>');
 		}

@@ -2330,13 +2302,12 @@ class WizStepSummary extends WizardStep
 		$oPage->add('</fieldset>');

 		$sJSONData = json_encode($aInstallParams);
-		$oPage->add('<input type="hidden" id="installer_parameters" value="'.htmlentities($sJSONData, ENT_QUOTES, 'UTF-8').'"/>');
+		$oPage->add('<input type="hidden" id="installer_parameters" value="'.utils::EscapeHtml($sJSONData).'"/>');

 		$sAuthentToken = $this->oWizard->GetParameter('authent', '');
 		$oPage->add('<input type="hidden" id="authent_token" value="'.$sAuthentToken.'"/>');

-		if (!$this->CheckDependencies())
-		{
+		if (!$this->CheckDependencies()) {
 			$oPage->error($this->sDependencyIssue);
 		}

@@ -2459,12 +2430,11 @@ JS
 		$oParameters->LoadFromHash(json_decode($sJSONParameters, true /* bAssoc */));
 		$oInstaller = new ApplicationInstaller($oParameters);
 		$aRes = $oInstaller->ExecuteStep($sStep);
-		if (($aRes['status'] != ApplicationInstaller::ERROR) && ($aRes['next-step'] != ''))
-		{
+		if (($aRes['status'] != ApplicationInstaller::ERROR) && ($aRes['next-step'] != '')) {
 			// Tell the web page to move the progress bar and to launch the next step
-			$sMessage = addslashes(htmlentities($aRes['next-step-label'], ENT_QUOTES, 'UTF-8'));
+			$sMessage = addslashes(utils::EscapeHtml($aRes['next-step-label']));
 			$oPage->add_ready_script(
-<<<EOF
+				<<<EOF
 	$("#wiz_form").data("installation_status", "running");
 	WizardUpdateButtons();
 	$('#setup_msg').html('$sMessage');
@@ -2479,7 +2449,7 @@ EOF
 		{
 			// Installation complete, move to the next step of the wizard
 			$oPage->add_ready_script(
-<<<EOF
+				<<<EOF
 	$("#wiz_form").data("installation_status", "completed");
 	$('#progress').progression( {Current:100, Maximum: 100} );
 	WizardUpdateButtons();
@@ -2487,13 +2457,11 @@ EOF
 	$("#btn_next").click();
 EOF
 			);
-		}
-		else
-		{
-			$sMessage = addslashes(htmlentities($aRes['message'], ENT_QUOTES, 'UTF-8'));
+		} else {
+			$sMessage = addslashes(utils::EscapeHtml($aRes['message']));
 			$sMessage = str_replace("\n", '<br>', $sMessage);
 			$oPage->add_ready_script(
-<<<EOF
+				<<<EOF
 	$("#wiz_form").data("installation_status", "error");
 	WizardUpdateButtons();
 	$('#setup_msg').html('$sMessage');
@@ -2626,8 +2594,8 @@ class WizStepDone extends WizardStep
 		}

 		$sForm = '<div class="ibo-setup--wizard--buttons-container" style="text-align:center"><form method="post" class="ibo-setup--enter-itop" action="'.$this->oWizard->GetParameter('application_url').'pages/UI.php">';
-		$sForm .= '<input type="hidden" name="auth_user" value="'.htmlentities($this->oWizard->GetParameter('admin_user'), ENT_QUOTES, 'UTF-8').'">';
-		$sForm .= '<input type="hidden" name="auth_pwd" value="'.htmlentities($this->oWizard->GetParameter('admin_pwd'), ENT_QUOTES, 'UTF-8').'">';
+		$sForm .= '<input type="hidden" name="auth_user" value="'.utils::EscapeHtml($this->oWizard->GetParameter('admin_user')).'">';
+		$sForm .= '<input type="hidden" name="auth_pwd" value="'.utils::EscapeHtml($this->oWizard->GetParameter('admin_pwd')).'">';
 		$sForm .= "<button id=\"enter_itop\" class=\"ibo-button ibo-is-regular ibo-is-primary\" type=\"submit\">Enter ".ITOP_APPLICATION."</button></div>";
 		$sForm .= '</form>';