| | |
| | $patterns[] = "(?P<punctuation>[\\{\\}\\(\\)\\[\\]\\;\\,])"; |
| | + // The "any" pattern ensures NO text remains raw |
| | + $patterns[] = "(?P<any>[\s\S])"; |
| | $combined = '/' . implode('|', $patterns) . '/msu'; |
| | |
| | return preg_replace_callback($combined, function ($matches) { |
| | foreach ($matches as $key => $value) { |
| | if (!is_numeric($key) && $value !== '') { |
| | if ($key === 'string_interp') { |
| | return $this->renderInterpolatedString($value); |
| | } |
| | - // Always encode the value here to prevent it from being treated as HTML |
| | + if ($key === 'any') { |
| | + return htmlspecialchars($value); |
| | + } |
| | return '<span class="hl-' . $key . '">' . htmlspecialchars($value) . '</span>'; |
| | } |