-
-
Notifications
You must be signed in to change notification settings - Fork 5.2k
[Book] Fixed highlighting issues #2265
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -1194,20 +1194,24 @@ this classic example: | |
|
||
.. configuration-block:: | ||
|
||
.. code-block:: jinja | ||
.. code-block:: html+jinja | ||
|
||
Hello {{ name }} | ||
|
||
.. code-block:: html+php | ||
|
||
Hello <?php echo $name ?> | ||
|
||
Imagine that the user enters the following code as his/her name:: | ||
Imagine that the user enters the following code as his/her name: | ||
|
||
.. code-block:: text | ||
|
||
<script>alert('hello!')</script> | ||
|
||
Without any output escaping, the resulting template will cause a JavaScript | ||
alert box to pop up:: | ||
alert box to pop up: | ||
|
||
.. code-block:: html | ||
|
||
Hello <script>alert('hello!')</script> | ||
|
||
|
@@ -1217,7 +1221,9 @@ inside the secure area of an unknowing, legitimate user. | |
|
||
The answer to the problem is output escaping. With output escaping on, the | ||
same template will render harmlessly, and literally print the ``script`` | ||
tag to the screen:: | ||
tag to the screen: | ||
|
||
.. code-block:: html | ||
|
||
Hello <script>alert('helloe')</script> | ||
|
||
|
@@ -1249,7 +1255,9 @@ Output Escaping in PHP | |
|
||
Output escaping is not automatic when using PHP templates. This means that | ||
unless you explicitly choose to escape a variable, you're not protected. To | ||
use output escaping, use the special ``escape()`` view method:: | ||
use output escaping, use the special ``escape()`` view method: | ||
|
||
.. code-block:: html+php | ||
|
||
Hello <?php echo $view->escape($name) ?> | ||
|
||
|
@@ -1258,7 +1266,7 @@ within an HTML context (and thus the variable is escaped to be safe for HTML). | |
The second argument lets you change the context. For example, to output something | ||
in a JavaScript string, use the ``js`` context: | ||
|
||
.. code-block:: js | ||
.. code-block:: html+php | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This should actually be There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @stof I know, but that is not support. Even more, JS is not supported. That's why I changed it to |
||
|
||
var myMsg = 'Hello <?php echo $view->escape($name, 'js') ?>'; | ||
|
||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This does not follow the Twig CS
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
you're right, I don't know why I did that... (will fix it soon)