I see a lot of occurences of this comment /* @escapeNotVerified */ in the template files for Magento2.
Does it have a special meaning?
Is there any use for this?


  • 29
    Hey...Why the downvote? I'm not allowed to ask questions?
    – Marius
    Commented Dec 8, 2015 at 12:07

2 Answers 2


This tag is used by static tests. Any potentially unsafe output must be marked with either @escapeNotVerified or @noEscape to pass tests, the latter means that this particular usage has been checked and is safe.

In the future releases all occurrences of @escapeNotVerified will be verified and either marked with @noEscape or escaped with one of these methods:

  • \Magento\Framework\View\Element\AbstractBlock::escapeHtml
  • \Magento\Framework\View\Element\AbstractBlock::escapeUrl
  • \Magento\Framework\View\Element\AbstractBlock::escapeXssInUrl
  • \Magento\Framework\View\Element\AbstractBlock::escapeQuote

Also note that some output is considered safe and should not be marked with such annotations:

  • Enclosed in single quotes
  • Enclosed in double quotes but without variables
  • Type casting to bool, int
  • Method calls which contain 'html' in their names, like getTitleHtml, are also expected to output escaped HTML
  • 3
    Greats answer @Alex
    – Amit Bera
    Commented Dec 8, 2015 at 9:24
  • Good Ans +1 @Alex :) Commented Mar 9, 2018 at 2:40
  • It helps +1 @Alex Commented Jul 13, 2018 at 6:39
  • 5
    At current pace, the replacement will be done approximately 2026 :D Commented Jan 24, 2019 at 8:48

I find it in devdocs of Magento2

Static Test

To improve security against XSS injections, a static test XssPhtmlTemplateTest.php is added to dev\tests\static\testsuite\Magento\Test\Php.

This static test finds all echo calls in PHTML-templates and determines if it is properly escaped or not.

It covers the following cases:

  • /* @noEscape */ before output. Output doesn’t require escaping. Test is green.

  • /* @escapeNotVerified */ before output. Output escaping is not checked and should be verified. Test is green.

Read the Magento Docs at 2.0 or 2.1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.