Re: [SMARTY-DEV] [patch] add $smarty->escape_output feature

I don't think you should require this in the template:

{if $foo|noescape eq "<bar>"}

The engine should determine that $foo is not output (not echo()), so it 
shouldn't get escaped in the first place.

foo is {$foo}

That should get escaped. The compiled template would be something like:
echo htmlspecialchars($this->_tpl_vars['foo'],ENT_QUOTES);

Andreas Korthaus wrote:
> Hi Monte!
>
> Monte Ohrt wrote:
>> Off the top of my head, you have to be careful to not escape the 
>> values when they are not direct output.
>
> The feature is intended for people, which do not assign strings to the 
> template, which SHOULD include valid HTML code (or XML or whatever). I 
> like to think about it as a contract: Every variable passed to my 
> template is "evil" and could include XSS code, so every output has to 
> get escaped. If you want to pass HTML to the template anyway, you have 
> two choices:
>
> 1. don't use $smarty->escape_output at all (it's only optional), or
>
> 2. use {$html_var|noescape} - if this is only a special case.
>
>
>> example:
>>
>> $smarty->assign('foo','<bar>');
>>
>> {$foo} <-- variable output, so escape so it comes out &lt;bar&gt;
>
> In my opinion this is bad design, but if you really need it in a 
> special case, do:
>
> {$foo|noescape}
>
> If that's something you often use in your templates and you think 
> that's good design, this feature is not intended for you, so simply 
> don't use it.
>
>> {if $foo eq "<bar>"} <-- do not escape $foo here, it is in an IF 
>> condition
>
> I don't use default_modifiers (as in the old patch), I have hooked my 
> methode only at compile-time, when the SmartyCompile found out that we 
> have a variabe or methode-call. And before this is written with "echo" 
> into the compiled template, I wrap an escape function around that - 
> but only if you use this feature.
>
> So if you set
>
> $smarty->escape_output = 'html';
>
> and pass
>
> $smarty->assign('foo','<bar>');
>
> to the script,
>
> {$foo}
>
> prints "&lt;bar&gt;"
>
> {$foo|noescape}
>
> prints "<bar>"
>
> and
>
> {if $foo eq "<bar>"}
>
> returns true.
>
> If you don't set $smarty->escape_output, everything will work as 
> today. No BC change.
>
> What do you think about integrating such a feature into smarty? If 
> this will be integrated, I'll create patches for all plugins (only a 
> few of them need a small change, which will not affect BC) to make 
> them "default escaping safe" ;-)
>
>
> Best regards
> Andreas
>