Index: branches/5.2.x/core/kernel/globals.php
===================================================================
diff -u -N -r15733 -r15856
--- branches/5.2.x/core/kernel/globals.php	(.../globals.php)	(revision 15733)
+++ branches/5.2.x/core/kernel/globals.php	(.../globals.php)	(revision 15856)
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version	$Id: globals.php 15733 2013-04-23 09:28:37Z alex $
+* @version	$Id: globals.php 15856 2013-07-02 14:56:00Z alex $
 * @package	In-Portal
 * @copyright	Copyright (C) 1997 - 2009 Intechnic. All rights reserved.
 * @license      GNU/GPL
@@ -21,6 +21,38 @@
 	const POUND_TO_KG = 0.45359237;
 
 	/**
+	 * Escape text as HTML.
+	 *
+	 * @see escape
+	 */
+	const ESCAPE_HTML = 'html';
+
+	/**
+	 * Escape text as JavaScript.
+	 *
+	 * @see escape
+	 */
+	const ESCAPE_JS = 'js';
+
+	/**
+	 * Escape text as Url.
+	 */
+	const ESCAPE_URL = 'url';
+
+	/**
+	 * Don't escape anything.
+	 */
+	const ESCAPE_RAW = 'raw';
+
+	/**
+	 * Current escape strategy.
+	 *
+	 * @var string
+	 * @see escape
+	 */
+	public static $escapeStrategy = self::ESCAPE_HTML;
+
+	/**
 	 * Similar to array_merge_recursive but keyed-valued are always overwritten.
 	 * Priority goes to the 2nd array.
 	 *
@@ -807,6 +839,66 @@
 		set_time_limit(isset($time_limit) ? $time_limit : 0);
 		ini_set('memory_limit', isset($memory_limit) ? $memory_limit : -1);
 	}
+
+	/**
+	 * Escapes a string.
+	 *
+	 * @param string $text     Text to escape.
+	 * @param string $strategy Escape strategy.
+	 *
+	 * @return string
+	 * @throws InvalidArgumentException When unknown escape strategy is given.
+	 */
+	public static function escape($text, $strategy = null)
+	{
+		if ( !isset($strategy) ) {
+			$strategy = self::$escapeStrategy;
+		}
+
+		if ( strpos($strategy, '+') !== false ) {
+			$previous_strategy = '';
+			$strategies = explode('+', $strategy);
+
+			foreach ($strategies as $current_strategy) {
+				// apply default strategy
+				if ( $current_strategy == '' ) {
+					$current_strategy = self::$escapeStrategy;
+				}
+
+				// don't double-escape
+				if ( $current_strategy != $previous_strategy ) {
+					$text = self::escape($text, $current_strategy);
+					$previous_strategy = $current_strategy;
+				}
+			}
+
+			return $text;
+		}
+
+		if ( $strategy == self::ESCAPE_HTML ) {
+			return htmlspecialchars($text, ENT_QUOTES, CHARSET);
+		}
+
+		if ( $strategy == self::ESCAPE_JS ) {
+			// TODO: consider using "addcslashes", because "addslashes" isn't really for JavaScript escaping (according to docs)
+			$text = addslashes($text);
+			$text = str_replace(array("\r", "\n"), array('\r', '\n'), $text);
+			$text = str_replace('</script>', "</'+'script>", $text);
+
+			return $text;
+		}
+
+		if ( $strategy == self::ESCAPE_URL ) {
+			return rawurlencode($text);
+		}
+
+		if ( $strategy == self::ESCAPE_RAW ) {
+			return $text;
+		}
+
+		throw new InvalidArgumentException(sprintf('Unknown escape strategy "%s"', $strategy));
+	}
+
 }
 
 /**