[patch] add $smarty->escape_output feature
| From: | Andreas Korthaus | Date: | Wed, 03 May 2006 18:12:22 +0000 |
| Subject: | [patch] add $smarty->escape_output feature | ||
| Groups: | php.smarty.dev | ||
| Request: | Send a blank email to php-smarty-dev+get-2852@lists.php.net to get a copy of this message | ||
Hi!
I've had a discussion with boots in the smarty forum about a new,
optional(!) smarty feature for general output escaping, which should not
break BC. The idea is to provide means for projects, which like to use
something like a contract, which ensures, that every output from
user-input in smarty template gets escaped if a special, new Smarty
member variable ($smarty->escape_output) is set (the used
escape-function is modifiable). Other template engines provide something
like that (e.g. flexy, savant), in Smarty this is not possible today
(forget about default_modifiers).
You can find the discussion here:
http://www.phpinsider.com/smarty-forum/viewtopic.php?t=7806
Attatched you can find a patch against CVS-HEAD, which implements the
basic functionality. It's not ready yet, because I did not catch every
point where input get's displayed without escaping.
From what I understand the smarty code, I think I have catched
everything beside some of the plugins. But I'm not sure here, so I'd be
very happy if someone with better knowledge of the smarty compiler could
check if it's OK.
And I'd like to know what your general opinion about such a feature is.
Best regards
Andreas