Symfony / Doctrine: Unserialize vs. Template
Can anyone tell me why the call to "unserialize" works fine in action but gives an offset error in the template?
Basically, it is possible to unserialize the result of the database text in a variable in an action and pass it to a template, in which case it displays a penalty:
$this->clean = unserialize($this->raw);
<?php echo $clean ?>
But not if it is called directly in the template:
<?php echo unserialize($raw) ?>
It would be interesting to know why this is the case and if there is a workaround.
Thanks.
a source to share
Symfony puts all template variables in a class sfOutputEscaperArrayDecorator
. So when you write unserialize($var)
, you are actually trying to unserialize the sfOutputEscaperArrayDecorator class.
I recommend turning off the output of the output in settings.yml:
escaping_strategy: false
This is a silly, performance-hitting, unnecessary Symfony feature that needs killing.
Update
If you disable escaping_strategy, you will need to manually sign in from users (to prevent XSS) with htmlSpecialCharacters()
.
The Symfony class does this for you, but that means it escapes every number and character as well - 99% of which you already know will be safe (IDs, dates, native content). When I turned off auto-escaping, my server load dropped significantly.
Keep in mind that Symfony applies this auto-escaping twice to this, if you pass sfOutputEscaperArrayDecorator
to partial, that is, it >
becomes&gt;
a source to share