nette / latte

☕ Latte: the safest & truly intuitive templates for PHP. Engine for those who want the most secure PHP sites.
https://latte.nette.org
Other
1.13k stars 109 forks source link

Escaping `application/ld+json`? #352

Closed simPod closed 10 months ago

simPod commented 10 months ago

Version: 3.0.12

Bug Description

I did not find a way how to force latte to escape double quotes in a json string. There's noescape helper but no escape helper or sth. Docs says latte should escape automatically but it does not seem to do so.

Steps To Reproduce

https://fiddle.nette.org/latte/#f147ffe9e0

{var $text = '"lorem" ipsum'}
<script id="json-ld-script" type="application/ld+json">
    {"text": "{$text}"}
</script>

It generates invalid json {"text": ""lorem" ipsum"}

Expected Behavior

Escaped double quotes

Possible Solution

Escape "