[MapServer]Save in map object doesn't distinguish between quotation and apostrophe

[nsavard@…]

PHP MapScript "save" method in "map" object doesn't distinguish between quotation and apostrophe. This may cause some parsing error when reading the new map. For example if a map contains the following string:

CONNECTION '<OGRVRTDataSource><OGRVRTLayer
name="pointOfInterest"><SrcDataSource>ODBC:sp-wms-TextDSN002,PointOfInterest</SrcDataSource><SrcLayer>PointOfInterest</SrcLayer><GeometryType>wkbPoint</GeometryType><LayerSRS>WGS84</LayerSRS><GeometryField
encoding="PointFromColumns" x="XCoord"
y="YCoord"/></OGRVRTLayer></OGRVRTDataSource>'

the new string will look like the following after using map->save:

CONNECTION "<OGRVRTDataSource><OGRVRTLayer
name="pointOfInterest"><SrcDataSource>ODBC:sp-wms-TextDSN002,PointOfInterest</SrcDataSource><SrcLayer>PointOfInterest</SrcLayer><GeometryType>wkbPoint</GeometryType><LayerSRS>WGS84</LayerSRS><GeometryField
encoding="PointFromColumns" x="XCoord"
y="YCoord"/></OGRVRTLayer></OGRVRTDataSource>"

[dmorissette]

This bug is not specific to PHP MapScript or OGR connections. It shows a deeper
problem with strings in mapserver mapfiles:it is not possible to have a string
with quotes in a mapserver mapfile. This is not new either, this issue has been
around since the early days of MapServer, but it's just worse today since we
make use of more complex string parameters in the mapfile that are more likely
to contain quotes.

I'll add other developers to get their thoughts on this.

I see a few options, in order of complexity:

1- Do nothing... not my preferred option

2- Create a msMapfileWriteString() function that would be smart enough to decide
on the delimiter to use to write the string to the mapfile (' or ") by looking
at the string to write, i.e. if the string contains double quotes then use
single quote as delimiter and vice-versa. This would still leave an issue for
strings that contain both single and double quotes

3- Come up with a new more complex string delimiter that is less likely to be
found in "normal" strings and can be used by strings that contain quotes and
double quotes, e.g. {{{  ...string... }}} for instance

4- Come up with a way to encode quotes inside a quoted string. A simple way
could be to decide that a quote (" or ') is encoded as a pair of quotes ("" or
''). This type of encoding would have the benefit of not breaking compatibility
with existing mapfiles since any mapfile with quotes inside strings wouldnot
load in today's parser.

5- Come up with some more advanced scheme...

Comments, suggestions?

I'll mark this as "4.4 release" but am interested in feedback on how important
you feel this is for 4.4.

[sdlime]

I really wish we could just handle it like everyone else. Escape characters in 
the mapfile (e.g. \" or \') and use a string writer to escape strings before 
saving them. This would involve:

1) fixing the string expression in the lexer to allow escaped characters in 
strings (better regex's)

2) writing a function to unescape the escaped characters in each string before 
handing to the functions in mapfile.c (that is, call in the lexer)

3) writing a string encoder for use in saving a mapfile

Call this a combination of 2,4 and 5. I really don't like options 1 and 3. If 
someone better than I at coding this stuff can help with the functions I can 
help with hooking it up. This scheme would not break old mapfiles.

My 2 cents...

Steve

[dmorissette]

I like the \" escape and had thought about it too, but there is a small chance
of breaking mapfiles which already contain some '\' in their strings: they would
need to be escaped as '\\'.

Other than that I'd be happy with that solution. I especially like the fact that
this is already a well-known way to escape chars in strings.

[dmorissette]

Too late for 4.4, but would be important for 4.6

[dmorissette]

I wonder if the changes to escape filter strings in #2123 could help with this one?