mirror of
https://github.com/twigphp/Twig.git
synced 2026-09-14 11:27:00 +00:00
Fabien Potencier
d6740f3682
This PR was squashed before being merged into the 1.x branch (closes #1855).
Discussion
----------
Fix custom escaper null values
First, a bit of context:
About 10 years ago, when I was doing some Java, I used to use a SQL mapper called iBatis (now moved to myBatis here: http://mybatis.github.io/mybatis-3/dynamic-sql.html)
The whole concept is to put SQL requests in XML files and use XML as a templating engine. Here is a code sample:
```xml
SELECT * FROM BLOG
WHERE state = ‘ACTIVE’
<if test="title != null">
AND title like #{title}
</if>
```
Fast forward today. I just realized Twig could be a great tool to do exactly the same. Just imagine:
```SQL
SELECT * FROM BLOG
WHERE state = ‘ACTIVE’
{% if title %}
AND title like {{ title }}
{% endif %}
```
All I need to do is write a custom escaper. Like this one:
```php
$twig->getExtension('core')->setEscaper('sql', function(\Twig_Environment $env, $string, $charset) use ($connection) {
// $connection is a DBAL connection
return $connection->quote($string);
});
```
Now, here is my problem:
For an SQL escaper to work, I would need *null* to translate into the 'NULL' string.
But in Twig, escapers are not triggered for null or numeric values. This is due to these lines of code: https://github.com/twigphp/Twig/blob/1.x/lib/Twig/Extension/Core.php#L1021-L1027
```php
if (!is_string($string)) {
if (is_object($string) && method_exists($string, '__toString')) {
$string = (string) $string;
} else {
return $string;
}
}
```
Everything that is not a string (i.e. a numeric value, null, an array...) is directly returned and completely bypasses the escaper.
I understand that this behaviour is ok in most cases (html, js, css, url, etc...), and that it allows some degree of optimisation, but it prevents from working on more specific escapers like a SQL escaper. It is also an undocumented behaviour of custom escapers.
This pull request tries to fix this without impacting performance.
In most Twig installations, no custom escapers are used. In this cases, returning early is a good idea since all default escapers share the same behaviour.
If there is a custom escaper configured however, I'm going the "long" route to be sure that the custom escaper is fed with all values (and not only non empty strings)
Commits
-------
6f84981 Fix custom escaper null values
Twig, the flexible, fast, and secure template language for PHP ============================================================== Twig is a template language for PHP, released under the new BSD license (code and documentation). Twig uses a syntax similar to the Django and Jinja template languages which inspired the Twig runtime environment. More Information ---------------- Read the `documentation`_ for more information. .. _documentation: http://twig.sensiolabs.org/documentation