function locale_string_is_safe

Check that a string is safe to be added or imported as a translation.

This test can be used to detect possibly bad translation strings. It should not have any false positives. But it is only a test, not a transformation, as it destroys valid HTML. We cannot reliably filter translation strings on import because some strings are irreversibly corrupted. For example, an & in the translation would get encoded to & by \Drupal\Component\Utility\Xss::filter() before being put in the database, and thus would be displayed incorrectly.

The allowed tag list is like \Drupal\Component\Utility\Xss::filterAdmin(), but omitting div and img as not needed for translation and likely to cause layout issues (div) or a possible attack vector (img).

See also

https://www.drupal.org/node/3616293

File

core/modules/locale/locale.module, line 602

Code

function locale_string_is_safe($string) {
  @trigger_error(__FUNCTION__ . '() is deprecated in drupal:11.5.0 and is removed from drupal:13.0.0. Use LocaleXss::stringIsSafe() instead. See https://www.drupal.org/node/3616293', E_USER_DEPRECATED);
  return LocaleXss::stringIsSafe($string);
}