fix: escape single quotes in View::e()

Pass ENT_QUOTES|ENT_SUBSTITUTE and UTF-8 to htmlentities so single-quoted
attributes are escaped on PHP 7.4/8.0 as well as 8.1+.
pull/728/head
Ambrose Casanova 4 days ago
parent a406f917e8
commit 6b8d2f9880

@ -191,7 +191,7 @@ class View
*/ */
public function e(string $str): string public function e(string $str): string
{ {
$value = \htmlentities($str); $value = \htmlentities($str, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
echo $value; echo $value;
return $value; return $value;
} }

@ -133,6 +133,17 @@ class ViewTest extends TestCase
$this->assertEquals('script', $result); $this->assertEquals('script', $result);
} }
public function testEEscapesSingleQuote(): void
{
$expected = htmlentities("'", ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
$this->expectOutputString($expected);
$result = $this->view->e("'");
$this->assertEquals($expected, $result);
$this->assertEquals(''', $result);
}
public function testNormalizePath(): void public function testNormalizePath(): void
{ {
$viewMock = new class extends View $viewMock = new class extends View

Loading…
Cancel
Save