Enable autoescaping in volt, but do not apply to partial(), include() etc

{% autoescape false %}
        {% include "partials/your_file" %}
{% endautoescape %}

Would that work for you?

Unfortunately not. That would also disable autoescaping of all tags inside your_file.

I just want to disable it for the include/partial functions, but not for anything else.

Also you're including using {% %}, that seems wrong?

Yes, mistake on {% include %}, should've been {{ }}.

So, I am still not seeing the problem, why don't you again autoescape whatever you want within the included file?

Or, seems I don't understand you completly.

Yes, mistake on {% include %}, should've been {{ }}.

So, I am still not seeing the problem, why don't you again autoescape whatever you want within the included file?

Or, seems I don't understand you completly.

You're right. I can enable and disable autoescape every time I include a partial:

index.volt

{% autoescape false %} {{ partial("partial")

partial.volt

{% autoescape true %} / partial stuff /

But that means 2 extra lines of code every time I want to include a partial. There's also a security risk that I forget to enable it again.

You can try to extend and override functionality in Volt component which will add filters and pass call to a parent method.

Good suggestion. I've tried to add an 'unescape' filter usable like {{ partial("..") | unescape })} that disables the autoescape and enables it again as soon as the compileEcho function is called. Unfortunately filters are parsed after compileEcho and not before, so this didn't work.

Thanks for all the suggestions so far though guys.

I think I'll attempt to do a pull request later that adds new syntax similar to {! partial("..") !} which disables the escaper for this one specific echo. I'll have to dive into the C part of phalcon a bit but I'll figure it out.

You can try to extend and override functionality in Volt component which will add filters and pass call to a parent method.

After thinking this through a second time I think I've found a solution using filters which is also really simple. So I'm going to accept your answer.

My syntax to disable escaping now looks like this: {{ partial("partials/assets") | nae }} which looks good enough to me.

I've added the following filter to the volt compiler:

$compiler->addFilter('nae', function ($resolvedArgs, $exprArgs) {
    return $resolvedArgs . ', true';
});

This filter literally hacks a 2nd argument to the code, so the compiled volt with autoescape enabled will look like this:

<?= $this->escaper->escapeHtml($this->partial('partials/assets'), true) ?>

After that I've overwritten the escaper class to use this 2nd argument to ignore the escape action after all:

<?php

namespace Phalcon;

class MyEscaper extends Escaper
{
    public function escapeHtml($text, $ignoreAnyways = false)
    {
        if ($ignoreAnyways) {
            return $text;
        }

        return parent::escapeHtml($text);
    }
}

Now we just have to use our custom class in our DI:

$di->setShared('escaper', new \Phalcon\MyEscaper());

Very nice! The flexibility of this framework continues to amaze me.

Excellent! Good approach!

You see, Phalcon AND PHP are win win!