Question

I have recently found out that Smarty, differently from Django template engine, does not escape variables automatically and I need to put |escape next to most of the variables in my templates.

Following the docs, http://www.smarty.net/docsv2/en/variable.default.modifiers.tpl I need to set default modifiers, needn’t I?

So, here’s my code:

$smarty = new Smarty();
$smarty->default_modifiers = array('escape:"htmlall"');

… and still variables ARE NOT escaped until I add |escape next to them.

What am I doing wrong?

Answer 1

If you are on Smarty 3, try this:

$smarty = new Smarty();
$smarty->loadFilter(Smarty::FILTER_VARIABLE, "htmlentities");

Tadà!

Update: Smarty::FILTER_VARIABLE is undocumented as of 28/11/2014. Use $smarty->escape_html = true if you want to stick to offical docs.