I noticed class
vendor/magento/framework/Escaper.php which contains a few useful security methods used inside (mainly) templates. Some of them are quite common (
escapeHtml()), but some of them are hard to encounter.
- What method and
- In case of method
escapeJsQuote()- what is the place where these quotes can be found? Only inline
- Does anyone has some clear explanation when all methods should be used (practical examples)?
- What is a difference between
escapeXssInUrl()and if second one grants us better security, why not always use second one instead escaping only html chars?
escapeQuote()should be used for example for echoing some variable in situation like this
<div value="<?php echo[here?]