twigfiddle.com - HTML escaping strategies

More options...

Title

File

{% autoescape 'html' %}

Why it is useless to |e on .html.twig? Because HTML autoescaping is enabled by default:
&amp;|raw zzzzz
{{ testA }}
  
{{ testA | e }}

... both strings are the same.

---

Why should I escape my variables on HTML attributes anyway?

<a title="{{ testB }}" />

<a title="{{ testB | e('html_attr') }}" />

As you can see, a stronger escaping is required on HTML attributes.

{% endautoescape %}

Format

testA: i am an <html> string
testB: I'm a string containing "simple" and "double" quotes

Fiddle eeje9y v34 created on March 30, 2020 06:20 and visited 249 times

Developed using

Not logged in.

twigfiddle.com @ 2024
Ask a question on Stackoverflow Report issue Download source code