From 6b8d2f9880ca21f89a12565b278fc9d0e00f2df3 Mon Sep 17 00:00:00 2001
From: Ambrose Casanova <279373485+ambrose5773@users.noreply.github.com>
Date: Fri, 4 Sep 2026 02:53:16 +0000
Subject: [PATCH] fix: escape single quotes in View::e()

Pass ENT_QUOTES|ENT_SUBSTITUTE and UTF-8 to htmlentities so single-quoted
attributes are escaped on PHP 7.4/8.0 as well as 8.1+.
---
 flight/template/View.php |  2 +-
 tests/ViewTest.php       | 11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/flight/template/View.php b/flight/template/View.php
index fae471f..17622fd 100644
--- a/flight/template/View.php
+++ b/flight/template/View.php
@@ -191,7 +191,7 @@ class View
      */
     public function e(string $str): string
     {
-        $value = \htmlentities($str);
+        $value = \htmlentities($str, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
         echo $value;
         return $value;
     }
diff --git a/tests/ViewTest.php b/tests/ViewTest.php
index e57afd0..56a6e0e 100644
--- a/tests/ViewTest.php
+++ b/tests/ViewTest.php
@@ -133,6 +133,17 @@ class ViewTest extends TestCase
         $this->assertEquals('script', $result);
     }
 
+    public function testEEscapesSingleQuote(): void
+    {
+        $expected = htmlentities("'", ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+
+        $this->expectOutputString($expected);
+        $result = $this->view->e("'");
+
+        $this->assertEquals($expected, $result);
+        $this->assertEquals('&#039;', $result);
+    }
+
     public function testNormalizePath(): void
     {
         $viewMock = new class extends View