Merge pull request #117 from utopia-php/feat-template-escape-html-by-…

…default feat: escape html by default in view params
utopia-php · Jan 8, 2024 · e3ff6b9 · e3ff6b9
2 parents ad6f7e6 + 5b62a82
commit e3ff6b9
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/src/View.php b/src/View.php
@@ -77,12 +77,16 @@ public function __construct(string $path = '')
      *
      * @throws Exception
      */
-    public function setParam(string $key, mixed $value): static
+    public function setParam(string $key, mixed $value, bool $escapeHtml = true): static
     {
         if (\strpos($key, '.') !== false) {
             throw new Exception('$key can\'t contain a dot "." character');
         }
 
+        if (is_string($value) && $escapeHtml) {
+            $value = \htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
+        }
+
         $this->params[$key] = $value;
 
         return $this;

diff --git a/tests/ViewTest.php b/tests/ViewTest.php
@@ -83,4 +83,10 @@ public function testCanFilterNewLinesToParagraphs()
     {
         $this->assertEquals('<p>line1</p><p>line2</p>', $this->view->print("line1\n\nline2", View::FILTER_NL2P));
     }
+
+    public function testCanSetParamWithEscapedHtml()
+    {
+        $this->view->setParam('key', '<html>value</html>');
+        $this->assertEquals('&lt;html&gt;value&lt;/html&gt;', $this->view->getParam('key', 'default'));
+    }
 }