Skip to content
Snippets Groups Projects
Commit 48e6b0ba authored by Sean Madsen's avatar Sean Madsen
Browse files

Security - remove confusing example

I think that if we want this example in there, we need to explain more
about how it works.
parent 2e4d9cb1
No related branches found
No related tags found
No related merge requests found
......@@ -118,11 +118,7 @@ CiviCRM has long been confused and staggered in regards to whether to escape on
This will ensure that the variable title within the item key when generating a list of recently viewed items won't have any Cross Site Scripting as it will be escaped for use within HTML. For more information on the types of escaping you can do with Smarty see the [Smarty Documentation](https://www.smarty.net/docsv2/en/language.modifier.escape)
However sometimes to escape on output you need to ensure that because of the complex nature of the variable that the variable is properly escaped when passed to Smarty. For example, when building a json encoded blob of data for use in an contribution form it was necessary to escape before passing onto the Smarty Template.
```php
$form->assign('submittedOnBehalfInfo', json_encode(str_replace('"', '\"', $form->_submitValues['onbehalf']), JSON_HEX_APOS));
```
For AngularJS templates, developers should consult the AngularJS [$sanitize documentation](https://docs.angularjs.org/api/ngSanitize/service/$sanitize).
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment