Over a million developers have joined DZone.
{{announcement.body}}
{{announcement.title}}

Smarty and escaping user input (for lazy guys)

DZone's Guide to

Smarty and escaping user input (for lazy guys)

· Web Dev Zone ·
Free Resource

Deploying code to production can be filled with uncertainty. Reduce the risks, and deploy earlier and more often. Download this free guide to learn more. Brought to you in partnership with Rollbar.

Smarty gives us a simple way to escape “dirty” variables when they come to template processing. With escape variable modifier you can make “dirty” things look smart. You can escape or even remove html tags and special characters.

Variable in a Smarty template without escaping {$articleTitle}
and with escaping {$articleTitle|escape:'html'}

But if you are lazy like me you might wonder what the need to write “escape:’html’” again and again for all variables. Good new is that we can make Smarty do it by default by setting $default_modifiers field for Smarty object. For lazy guys here is sample

$smarty->default_modifiers = array('escape:"html"');

We can turn off this “defaul” behaviour for selected variables with

{$var|smarty:nodefaults}
Be Smarty and good luck! :)

Deploying code to production can be filled with uncertainty. Reduce the risks, and deploy earlier and more often. Download this free guide to learn more. Brought to you in partnership with Rollbar.

Topics:

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}