Pros and cons of escape strategies in symfony
I'm still not sure about this. When enabled, we are perfectly safe, but some other problems appear (with passing template variables or character counting). On the other hand, we have magic disabled, everything is clear, but we need to manually infer each variable (which comes from an untrusted source) in templates. By the way, the non-magic solution is used in Ruby-on-Rails.
So the question is: when starting a new project in symfony, do you disable escaping_strategy and why?
+2
a source to share
1 answer
See the answer to this question for an opinion: Symfony / Doctrine: Unserialize in action vs template
I would also like to get more information on this issue because it is not very clear.
0
a source to share