/**
* Straight-forward strategy: use PHP's tokenizer to escape everything that
* looks like PHP.
*
* We open/close PHP tags at the beginning of the template to clearly indicate
* that we are in HTML mode.
*
* Known issue: templates need to be rechecked everytime the value of the php.ini
* settings asp_tags or short_tags are changed
*/
do
{
	$tokens = token_get_all('<?php ?>' . $code);
	$code = '';
	$php_found = false;

	foreach ($tokens as $i => $token)
	{
		if (!is_array($token))
		{
			$code .= $token;
		}
		else if ($token[0] == T_OPEN_TAG || $token[0] == T_CLOSE_TAG)
		{
			if ($i > 1)
			{
				$code .= htmlspecialchars($token[1]);
				$php_found = true;
			}
		}
		else
		{
			$code .= $token[1];
		}
	}
	unset($tokens);

	/**
	* Fix for a tokenizer oddity
	*/
	if (!strncmp($code, '<?php ?&gt;', 11))
	{
		$code = substr($code, 11);
	}
}
while ($php_found);