Skip to content

Conversation

@ChrisDBrown
Copy link

From the Twig documentation the different html escapes are (emphasis mine):

  • html: escapes a string for the HTML body context, or for HTML attributes values inside quotes.
  • html_attr: escapes a string when used as an HTML attribute name, and also when used as the value of an HTML attribute without quotes (e.g. data-attribute={{ some_value }}).

The example code here is inside quotes:

<div data-user-profile="{{ app.user ? app.user.profileData|json_encode|e('html') }}">
    <!-- ... -->
</div>

so it seems better to recommend html as the escape strategy. It'd perhaps be better still to highlight this difference in the Symfony docs?

@ChrisDBrown ChrisDBrown marked this pull request as ready for review November 19, 2025 11:21
@carsonbot carsonbot added this to the 6.4 milestone Nov 19, 2025
@ChrisDBrown ChrisDBrown changed the title [Frontend] Correct escape type for HTML attribute example Correct escape type for HTML attribute example Nov 19, 2025
@carsonbot carsonbot changed the title Correct escape type for HTML attribute example Correct escape type for HTML attribute example Nov 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants