auraphp / aura.html Goto Github PK

Hi Paul,

I forget there is a way to call h(), j() etc without making use of

<?php 
use Aura\Html\Escaper as e; 
e::h('Hello World');
?>

like adding a functions.php file and having something like

<?php
use Aura\Html\Escaper; 
function h($raw) 
{
    return Escaper::h($raw);
}

And this can be autoloaded by composer.

And I would like to alter the getStatic() to make sure the Escaper object is there.

    public static function getStatic()
    {
        if (! static::$escaper) {
            $html = new HtmlEscaper($this->flags, $this->encoding);
            $attr = new AttrEscaper($html, $this->encoding);
            $css = new CssEscaper($this->encoding);
            $js = new JsEscaper($this->encoding);
            static::$escaper = new self($html, $attr, $css, $js);
        }
        return static::$escaper;
    }

This make calling as h("Hello World") I guess 👍 .

Not sure whether you like or not.

see: http://php.net/manual/en/function.htmlspecialchars.php

I have a case where I would like to use the double_encode flag.

I understand why you probably don't want to in most cases.
As how would you deal with the following: The HTML entity for "&" is "&".
see: http://stackoverflow.com/questions/16646577/

In my case though I have integrated the Foil view engine into a Wordpress theme.
Foil uses this library for all it's escaping and by default it auto escapes everything, which is great 95% of the time.

There are cases though where Wordpress has already escaped a value, say the "Post Title".
And then foil comes along and escapes again. The solution is to turn off auto escaping and manually escape where needed.

Then I saw the double_encode flag, and figured that would solve my issue.
Went looking for a way to set it through Foil, no dice, then I came here and looked through the source and noticed there is indeed no way to set it.

https://github.com/auraphp/Aura.Html/blob/2.x/src/Escaper/HtmlEscaper.php#L73

If you have strong opinions that the flag is a big NO NO, thats fine however if you think it is something that could be made configurable through your API I will create a pull request for the feature.

Cheers Brad

@harikt I went ahead and released 2.5.0 as we talked about in #53.

Perhaps I was a bit hasty, since I just opened #55, but I got a little excited when you figured out the stuff with travis. :)

I have to fill my select widget with options, which contains numeric keys. Unfortunately the select helper does not detect the selected value because of the strict value checking in https://github.com/auraphp/Aura.Html/blob/develop-2/src/Helper/Input/Select.php#L257

// example with integer keys
$options = array('one', 'two');
$field->setOptions($options);

// example with string keys, but converted to integers by php
$options = array('0' => 'one', '1' => 'two');
$field->setOptions($options);

Both examples will have integer array keys.

There seems to be some issues with the automatically type convertion of PHP.

1. PHP gets numbers as string in $_POST (I simply filled my form using the post array)
2. PHP converts numeric keys set as string to integers in arrays.
3. The select helper will fail because the post value is a string, the defined value is an integer.

Maybe something is wrong with my PHP setup but at the moment I can not use the select helpers because of the strict value checking.

I don't see a way to call the helpers inside the helpers.

Else we need to duplicate the code of the other html helpers.

I found where you fixed the Select issue for this, but the same issue can be found within Aura\Html\Helper\Input\AbstractChecked, which causes issues with the radio inputs (since they are set using the options array as well). Could you implement the same fix you did with the Select, or create a different fix?

To run the unit tests at the command line, go to the tests/unit directory and issue ./phpunit.sh. (This requires [PHPUnit][] to be available as phpunit.)

I think to run the unit test you don't need users to force to go via ./phpunit.sh I also wonder whether this works in windows then .

Let them run unit tests via phpunit . In case of integration I am ok with ./phpunit.sh for it needs installing the aura/di . ( this gives another thought on windows also ) My suggestion is rather keeping it for all we need to write a page in the website with testing.

Which can mention the unit and integration testing.

Is JsEscaper duplicating the behavior of json_encode()?

Isn't this code essentially equivalent to, say, substr(json_encode($value), 1, -1) ?

Is there any benefit to re-implementing this?

Also, is it necessary to escape multi-byte UTF-8 characters in the first place? json_encode() lets you disable unnecessary unicode escapes with the JSON_UNESCAPED_UNICODE flag.

For non-UTF-8 (e.g. ASCII) output, unicode escaping is required - but the likely use-case is outputting UTF-8 strings, right? So why escape everything as ASCII?

In IDE autocomplete for HelperLocator class doesn't have basic helpers like a, base etc

Would you like to add it there? It could be achieved by adding PHPdoc to HelperLocator:

/**
* @method Helper\Anchor a($href, $text, array $attr = array())
*/

The check in if ($raw === '' || ctype_digit($raw)) { throws a deprecation warning in PHP 8.1:

ctype_digit(): Argument of type int will be interpreted as string in the future

There are 2 places: AbstractEscaper:119 and HtmlEscaper:68

I think the best solution is to cast $raw to string in the beginning

@jakejohns Since you are putting so much effort into this package, and since I am so slow to respond, how would you feel about becoming the package owner? Full authority and responsibility over it, etc. (And if you can't, no big deal.) Thanks, hope you are doing well!

Is there any way to use decorators in forms? It would be nice to switch between default raw HTML, Foundation, Bootstrap and other CSS frameworks.