085_autoescape.php

open standalone ↗
PHP Source 
<?php

///////////////////////////////////////////////////////////////////////////////
// Auto-escape mode automatically HTML-encodes all {$var} output.            //
// Use |raw to opt out for trusted content.                                  //
///////////////////////////////////////////////////////////////////////////////

include("../sluz.class.php");
$s = new sluz();

$s->setEscapeHtml(true);

$s->assign("name"        , "<b>Scott</b>");
$s->assign("user_input"  , "<script>alert('XSS')</script>");
$s->assign("trusted_html", "<em>Safe HTML</em>");

print $s->fetch("tpls/085_autoescape.stpl");
TPL Template 
<h1>Auto-escape Mode</h1>

<p>Raw variable: {$name}</p>

<p>User input (auto-escaped): {$user_input}</p>

<p>Trusted HTML with |raw: {$trusted_html|raw}</p>

<p>Chained with |escape (no double-escape): {$user_input|escape}</p>

<p>Chained with |strtoupper then auto-escaped: {$name|strtoupper}</p>
OUT Live output iframe preview