smarty-php / smarty

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic.
Other
2.24k stars 705 forks source link

escape_html generates incorrect php code #928

Closed wxiaoguang closed 7 months ago

wxiaoguang commented 7 months ago

When setting escape_html=true, the following code:

{$foo+$bar}

becomes:

<?php echo htmlspecialchars((string) $_smarty_tpl->tpl_vars['foo']->value+$_smarty_tpl->tpl_vars['bar']->value, ENT_QUOTES, 'UTF-8');?>

The code: (string) $a + $b is not correct, maybe it should be (string) ($a + $b).