2017 © Pedro Peláez
 

library safer-blitz

image

crocodile2u/safer-blitz

  • Thursday, February 1, 2018
  • by crocodile2u
  • Repository
  • 1 Watchers
  • 0 Stars
  • 9 Installations
  • PHP
  • 0 Dependents
  • 0 Suggesters
  • 0 Forks
  • 0 Open issues
  • 4 Versions
  • 0 % Grown

The README.md

safer-blitz

A small extension to Blitz template engine, adding template inheritance and auto-escaping., (*1)

Template inheritance

article.tpl:, (*2)

<article>text</article>

layout.tpl:, (*3)

<header/>
{{ raw(content) }}
<footer/>

PHP code:, (*4)

$view = new View("article.tpl");
$view->extend("layout.tpl");
echo $view->parse();

The output:, (*5)

<header/>
<article>text</article>
<footer/>

Auto-escaping

Initialize view:, (*6)

$view = new \SaferBlitz\View;

In template:, (*7)

{{ $some_variable }}

In controller:, (*8)

$view->set(["some_variable" => "some nasty XSS attempt: \"><script>alert(\"XSS\");</script>"]);
$view->display();

Result:, (*9)

some nasty XSS attempt: &quot;&gt;&lt;script&gt;alert(&quot;XSS&quot;);&lt;/script&gt;

To output variable unescaped, use raw($var) template API:, (*10)

{{ raw($trusted_variable) }}

If anyone appears to be interested in this project, I will probably add proper escape methods to escape attributes, CSS, JS. For now, this is out of my personal scope of use though., (*11)

The Versions

01/02 2018

dev-master

9999999-dev

  Sources   Download

The Requires

  • ext-blitz *

 

The Development Requires

01/02 2018

1.1.1

1.1.1.0

  Sources   Download

The Requires

  • ext-blitz *

 

The Development Requires

31/01 2018

1.1

1.1.0.0

  Sources   Download

The Requires

  • ext-blitz *

 

The Development Requires

22/12 2016

v1.0.0

1.0.0.0

  Sources   Download

The Requires

  • ext-blitz *