Question

My understanding is that all variables should be output through htmlspecialchars() in a view.

Are there any approaches or methods to do this, without having to specify the function on each appropriate line in each view?

The best that I could come up with is to have a helper function as follows:
function html_escape($var)

function h($var)
{
  if (is_array($var))
  {
    return array_map('h', $var);
  }
  else
  {
    return htmlspecialchars($var, ENT_QUOTES, 'UTF8');
  }
}

But still…this could get very tedious!

Any ideas?

Answer 1

You may have the function h() output the escaped data, rather than return it. Therefore, instead of writing <?php echo h($myvar); ?> you may write <?php h($myvar); ?>. This is now two characters shorter than echoing the variable without converting to entities.