Pros and cons of escaping strategies in symfony

Posted by zergu on Stack Overflow See other posts from Stack Overflow or by zergu
Published on 2010-04-28T07:49:58Z Indexed on 2010/04/28 7:53 UTC
Read the original article Hit count: 284

Filed under:

symfony

|

escaping

I am still not sure in that matter. While turned on we're quite safe but some other problems appear (with passing template variables or counting characters). On the other hand we have magic turned off, everything is clear, but we have to manually escape every variable (that come from untrusted source) in templates. By the way, non-magic solution is used in Ruby-on-Rails.

So the question is: when starting a new project in symfony do you disable escaping_strategy and why?

© Stack Overflow or respective owner

Related posts about symfony

Symfony/Doctrine/SfGuardPlugin: Redirect to requested page (route), and not referrer

as seen on Stack Overflow - Search for 'Stack Overflow'
I want to be able to take the user to the requested page after login, but this does not happen with sfGuard. ** My Register action requires SignIn ;) ** On the listing page [http://cim/frontend_dev.php/] - user clicks the 'Register' link [@register = register/index] - user is taken to 'Signin' page… >>> More
Symfony and doctrine searchable sfDoctrinePager (symfony 1.4)

as seen on Stack Overflow - Search for 'Stack Overflow'
Can someone help me on paginating results with sfDoctrinePager? $articlesResults = Doctrine::getTable('Article') ->getTemplate('Doctrine_Template_I18n') ->getPlugin() … >>> More
Seems doctrine listener is not fired

as seen on Stack Overflow - Search for 'Stack Overflow'
Got a service which should be executed the moment an object is persisted. Though, I think the code looks like it should work, it doesn't. I configured the service like the following yml. services: bla_orm.listener: class: Bla\OrmBundle\EventListener\UserManager arguments:… >>> More
Ubuntu 13.10 Symfony installation date time issue

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm installing Symfony on my Ubuntu system, everything was going fine until the very last moment when I was met with a screen that said: ContextErrorException: Warning: date_default_timezone_get(): It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone… >>> More
Propel-load-data is causing an error

as seen on Stack Overflow - Search for 'Stack Overflow'
I am trying to load fixtures but myproject is erroring at the CLI and starting the indexer process. I have tried: Rebuilding the schema and model Emptying the database and starting again Clearing the cache Validating the YML file and trying much simpler data-dumps My platform is Symfony 1.0… >>> More

Related posts about escaping

XSLT disable output escaping when disable-output-escaping is not supported

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi folks, Since disable-output-escaping doesn't work on firefox (and isn't going to), whats the next best way of including raw markup in the output of an XSTL transform? (Background: I've got raw HTML in a database that I want to wrap in XML to send to a browser to render. I've got control of… >>> More
Escaping Generics with T4 Templates

as seen on Geeks with Blogs - Search for 'Geeks with Blogs'
I've been doing some work with T4 templates lately and ran into an issue which I couldn't find an answer to anywhere. I finally figured it out, so I thought I'd share the solution. I was trying to generate a code class with a T4 template which used generics The end result a method like: public… >>> More
How to escape or remove double quotes in rsyslog template

as seen on Server Fault - Search for 'Server Fault'
I want rsyslog to write log messages in JSON format, which requires to use double-quotes (") around strings. Problem is that values sometime include double-quotes themselves, and those need to be escaped - but I can't figure out how to do that. Currently my rsyslog.conf contains this format that… >>> More
Searching for literal "> \" using ack-grep

as seen on Server Fault - Search for 'Server Fault'
I am looking for lines that literally have a greater than character (a "") followed by a space followed by a backslash character (a "\") i.e., a line with this: \ I thought escaping would allow this, and for the greater-than it does: $ ack-grep " " returns lines that have " " in them. But… >>> More
Escaping equal sign in properties files

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi guys, How do i escape the equals ('=') sign in java properties file? i would like to put something like table.whereclause=where id=100 . thanks. Josh >>> More