setEscapeHtml true will also escape output of functions in smarty 5 about smarty HOT 3 CLOSED

Good catch! That change was unintentional and I think we should fix it.

from smarty.

@timmit-nl the fix was easy enough, but thinking through this, I feel that the behavior of functions, block-tags and auto-escaping is under-defined. In any case, the documentation is rather vague about this. Many (but not all) of the built-in functions, such as {html_checkboxes} and {html_table} return html and are not auto-escaped in Smarty4. The same goes for the block plugins. But it feels rather arbitrary. What if your custom function or block tag produces valid HTML, but you need to auto-escape the result into a JSON string? Or vice versa?

It seems to me that function and block handlers should at least somehow indicate what they are returning, i.e. plain text, html, js, etc. That way, we would be able to apply auto-escaping when needed and refrain from it when not needed.

What do you think?

from smarty.

Yes that could be great. Some functions should be escaped, some not.

The only thing is, how do you give the result back, with the correct type. The type is in most cases (or always) a strict string. But how to differentiate is difficult on runtime.

But maybe when you register the function you tell what is is returning and possible an extra bool to force no escaping.

from smarty.