fix: escape single quotes in View::e()

Pass ENT_QUOTES|ENT_SUBSTITUTE and UTF-8 to htmlentities so single-quoted
attributes are escaped on PHP 7.4/8.0 as well as 8.1+.
pull/728/head
Ambrose Casanova 4 days ago
parent a406f917e8
commit 6b8d2f9880

@ -191,7 +191,7 @@ class View
*/
public function e(string $str): string
{
$value = \htmlentities($str);
$value = \htmlentities($str, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
echo $value;
return $value;
}

@ -133,6 +133,17 @@ class ViewTest extends TestCase
$this->assertEquals('script', $result);
}
public function testEEscapesSingleQuote(): void
{
$expected = htmlentities("'", ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
$this->expectOutputString($expected);
$result = $this->view->e("'");
$this->assertEquals($expected, $result);
$this->assertEquals(''', $result);
}
public function testNormalizePath(): void
{
$viewMock = new class extends View

Loading…
Cancel
Save