Re: [SMARTY-DEV] [patch] add $smarty->escape_output feature

Hi Monte!

Monte Ohrt wrote:
> Off the top of my head, you have to be careful to not escape the values 
> when they are not direct output.

The feature is intended for people, which do not assign strings to the 
template, which SHOULD include valid HTML code (or XML or whatever). I 
like to think about it as a contract: Every variable passed to my 
template is "evil" and could include XSS code, so every output has to 
get escaped. If you want to pass HTML to the template anyway, you have 
two choices:

1. don't use $smarty->escape_output at all (it's only optional), or

2. use {$html_var|noescape} - if this is only a special case.


> example:
> 
> $smarty->assign('foo','<bar>');
> 
> {$foo} <-- variable output, so escape so it comes out &lt;bar&gt;

In my opinion this is bad design, but if you really need it in a special 
case, do:

{$foo|noescape}

If that's something you often use in your templates and you think that's 
good design, this feature is not intended for you, so simply don't use it.

> {if $foo eq "<bar>"} <-- do not escape $foo here, it is in an IF condition

I don't use default_modifiers (as in the old patch), I have hooked my 
methode only at compile-time, when the SmartyCompile found out that we 
have a variabe or methode-call. And before this is written with "echo" 
into the compiled template, I wrap an escape function around that - but 
only if you use this feature.

So if you set

$smarty->escape_output = 'html';

and pass

$smarty->assign('foo','<bar>');

to the script,

{$foo}

prints "&lt;bar&gt;"

{$foo|noescape}

prints "<bar>"

and

{if $foo eq "<bar>"}

returns true.

If you don't set $smarty->escape_output, everything will work as today. 
No BC change.

What do you think about integrating such a feature into smarty? If this 
will be integrated, I'll create patches for all plugins (only a few of 
them need a small change, which will not affect BC) to make them 
"default escaping safe" ;-)


Best regards
Andreas