Twig
Twig copied to clipboard
The `autoescape` tag escapes already escaped value by the escape filter
According to the documentation of the autoescape tag:
Twig is smart enough to not escape an already escaped value by the escape filter.
But, when testing TwigPHP, it seems like the autoescape
tag actually do escape already escaped value by the escape filter:
{% set br = "<br/>" %}
{% autoescape "css" %}
{{ br|escape('html') }}
{% endautoescape %}
\26 lt\3B br\2F \26 gt\3B
https://twigfiddle.com/qtyoxi
So, which one is correct: TwigPHP implementation or the documentation?
When using automatic escaping, Twig tries to not double-escape a variable when the automatic escaping strategy is the same as the one applied by the escape filter;
css: escapes a string for the CSS context. CSS escaping can be applied to any string being inserted into CSS and escapes everything except alphanumerics.
Both are correct.
https://twig.symfony.com/doc/3.x/filters/escape.html
So one of the page of the documentation is wrong.
The note on the autoescape documentation is not explicit enough. But value|escape('css')
is not already escaped for html. So it is not wrong per se.