Re: [SMARTY-DEV] [patch] add $smarty->escape_output feature

Yep, I understand. But see my comment. You should only escape them on echo() Andreas Korthaus wrote:

Hi Monte! Monte Ohrt wrote:

Off the top of my head, you have to be careful to not escape the values when they are not direct output.

The feature is intended for people, which do not assign strings to the template, which SHOULD include valid HTML code (or XML or whatever). I like to think about it as a contract: Every variable passed to my template is "evil" and could include XSS code, so every output has to get escaped. If you want to pass HTML to the template anyway, you have two choices: 1. don't use $smarty->escape_output at all (it's only optional), or 2. use {$html_var|noescape} - if this is only a special case.

example: $smarty->assign('foo','<bar>'); {$foo} <-- variable output, so escape so it comes out &lt;bar&gt;

In my opinion this is bad design, but if you really need it in a special case, do: {$foo|noescape} If that's something you often use in your templates and you think that's good design, this feature is not intended for you, so simply don't use it.

{if $foo eq "<bar>"} <-- do not escape $foo here, it is in an IF condition

I don't use default_modifiers (as in the old patch), I have hooked my methode only at compile-time, when the SmartyCompile found out that we have a variabe or methode-call. And before this is written with "echo" into the compiled template, I wrap an escape function around that - but only if you use this feature. So if you set $smarty->escape_output = 'html'; and pass $smarty->assign('foo','<bar>'); to the script, {$foo} prints "&lt;bar&gt;" {$foo|noescape} prints "<bar>" and {if $foo eq "<bar>"} returns true. If you don't set $smarty->escape_output, everything will work as today. No BC change. What do you think about integrating such a feature into smarty? If this will be integrated, I'll create patches for all plugins (only a few of them need a small change, which will not affect BC) to make them "default escaping safe" ;-) Best regards Andreas