Auto escape
auto_escape — Overrides the compiler auto-escape setting within the block
Using function
auto_escape(mixed $enabled)enabled: if set to on, enable, true or 1 then the compiler autoescaping is enabled inside this block. set to off, disable, false or 0 to disable it.
How easy it is to use in .tpl files, with additional parameters or using the enabling/disabling escaping, is shown below:
Example #1 no escaping:
{$user="<a href=\"javascript:jsAttack()\">EvilTroll</a>"}
{$user}
The above example will output: Interpreted as HTML by the browser
<a href="javascript:jsAttack()">EvilTroll</a>
{auto_escape on}
{$user} {* here any injected html is escaped so it's safe *}
{/auto_escape}
The above example will output: Interpreted as text by the browser
& lt;a href="javascript:jsAttack()"& gt;EvilTroll& lt;/a& gt;