Corviz / crow

Yet another template engine for PHP
https://corviz.github.io/crow/
MIT License
6 stars 2 forks source link

Advice: trimming quote marks in template extending #12

Open nael94 opened 3 months ago

nael94 commented 3 months ago

I advise you to trim quotations (single and double quotations) if they're passed in the custom template extending.

Here is an example:

[index.crow.php]
@mytestmethod('hello') // passing a string
@mytestmethod(hello)  // not a safe way to do this
[directives/Mytestmethod.php]
public function toPhpCode($parameters = null):string {
  $parameters = preg_replace('/^[\'"]|[\'"]$/', '', $parameters); // this must be a built-in value.
}

This will help trimming surrounding quotes when passing strings to work with it safely. For other types like boolean, integer, float, array, object, ..., they're now being handled as string. I think it should cast them as following:

I also advise you to pass variables as parameter in the view, like this way:

@section('body')
  <x-alert-box level="info">
    @mytestmethod($var) // here to pass variable, not a string "\$var"
  </x-alert-box>

  @mytestmethod('string!')
@endsection

Remember to fix declaring and working with variables using @php method in the @section in the views.

nael94 commented 2 months ago

Okay I've noticed that Method is an abstract, so toPhpCode has no default action to do unless to call it in each Method class. Unfortunately, I couldn't solve that point.