Question

Darn. Facing problem while outputting some variables in Smarty templates. Hope some one could help me out please.

I’m taking user input using textarea, which can contain anything from user (even script tags)…

I assign it to Smarty and print the variable, I write it in template as follows

{$description|nl2br}

But it shows
tag as it is, instead of having new line.

So to solve this, I used

{$description|nl2br nofilter}

It works well with
tags, but also user may input some scripts. Those scripts (javascript in tag) are getting executed…

I want something like where I can just convert new line chars to
and let only
tag execute, other tags should be printed safely.

Anyone here knows, how to make it work with Smarty well?

Answer 1

It sounds like you’re looking for something like {$description|escape:'htmlall'|nl2br}.

But your description makes it sound like you have $escape_html switched on, which might make it difficult to get the kind of fine-grained control you’re looking for. Try with and without nofilter, as I’m not 100% sure how you’re set up.