[patch] add $smarty->escape_output feature

From: Date: Wed, 03 May 2006 18:12:22 +0000
Subject: [patch] add $smarty->escape_output feature
Groups: php.smarty.dev 
Request: Send a blank email to php-smarty-dev+get-2852@lists.php.net to get a copy of this message
Hi! I've had a discussion with boots in the smarty forum about a new, optional(!) smarty feature for general output escaping, which should not break BC. The idea is to provide means for projects, which like to use something like a contract, which ensures, that every output from user-input in smarty template gets escaped if a special, new Smarty member variable ($smarty->escape_output) is set (the used escape-function is modifiable). Other template engines provide something like that (e.g. flexy, savant), in Smarty this is not possible today (forget about default_modifiers). You can find the discussion here: http://www.phpinsider.com/smarty-forum/viewtopic.php?t=7806 Attatched you can find a patch against CVS-HEAD, which implements the basic functionality. It's not ready yet, because I did not catch every point where input get's displayed without escaping. From what I understand the smarty code, I think I have catched everything beside some of the plugins. But I'm not sure here, so I'd be very happy if someone with better knowledge of the smarty compiler could check if it's OK. And I'd like to know what your general opinion about such a feature is. Best regards Andreas

« previous php.smarty.dev (#2852) next »