/**
* Straight-forward strategy: escape any token that is not inline HTML
*
* Known issue: templates need to be rechecked everytime the value of the php.ini
* settings asp_tags or short_tags are changed
*
* Known issue: doesn't work with <?php <?php die('H4X0R3D');
*/
$tokens = token_get_all('<?php ?>' . $code);
$code = '';
 
foreach ($tokens as $i => $token)
{
        if (!is_array($token))
        {
                $code .= $token;
        }
        elseif ($token[0] == T_OPEN_TAG || $token[0] == T_CLOSE_TAG)
        {
                if ($i > 1)
                {
                        $code .= htmlspecialchars($token[1]);
                }
        }
        else
        {
                $code .= $token[1];
        }
}
unset($tokens);
 
/**
* Fix for a tokenizer oddity
*/
if (!strncmp($code, '<?php ?&gt;', 11))
{
        $code = substr($code, 11);
}