Templa...scaping(3pm)

💖 Templa...scaping(3pm) 💖

okay bestie, welcome to the User Contributed Perl Documentation section, where this little page lives under the name Templa...scaping(3pm). buckle up, we're talking auto-escaping in Template-Toolkit and it's honestly iconic.

---

✨ NAME ✨

Template::Stash::AutoEscaping — escape automatically in Template-Toolkit. no cap, that's literally the whole job.

---

🦋 SYNOPSIS 🦋

  use Template;
  use Template::Stash::AutoEscaping;
  my $tt = Template->new({
    STASH => Template::Stash::AutoEscaping->new
  });

look at her go 💅 two use lines and a STASH and you're protected.

---

🎀 METHODS 🎀

🌸 new 🌸

she's the constructor, she takes a hashref of options, and here's the full menu:

• die_on_unescaped — if you set this to a true value, the process throws an exception the moment it bumps into a value that wasn't explicitly set to be escaped, or that was marked as a raw value. drama queen behaviour, but for safety 🫶
• escape_type — default is HTML.
• method_for_escape — the default method used to escape a value explicitly. mostly useful alongside "die_on_unescaped".
• method_for_raw — default is raw. so you can pull the not-escaped value out with [% value.raw %].
• escape_method — here's how you hand her your own escaping logic:

      my $tt = Template->new({
        STASH => Template::Stash::AutoEscaping->new({
            escape_method => sub { my $text = shift; ... ; return $text }
        })
      });

• ignore_escape — the escape-off switch, for when you need it:

      my $stash = Template::Stash::AutoEscaping->new({ignore_escape => [qw(include_html include_raw my_escape_func)], ... );

You can disable auto-escape for some value or TT-Macro. For example: include another component, for output-safety html, using another escape method, etc. etc. the list goes on ✨

💜 class_for 💜

  Template::Stash::AutoEscaping->class_for("HTML") # Template::Stash::AutoEscaping::Escaped::HTML
  Template::Stash::AutoEscaping->class_for("HTML" => "MyHTMLString");

two ways to call her, same energy.

🧚 escape 🧚

For internal use. (iykyk, don't touch 👑)

🧚 escape_count 🧚

For internal use.

🧚 get 🧚

For internal use.

🧚 get_raw_args 🧚

For internal use.

---

🔥 DESCRIPTION 🔥

Template::Stash::AutoEscaping is a sub class of Template::Stash that automatically escapes all HTML strings and avoids XSS vulnerability. that's it, that's the vibe — your templates stay cute and safe 🌈

---

⭐ CONFIGURE ⭐

• $Template::Stash::AutoEscaping::ESCAPE_ARGS — default is 0. for example "key of hash" or "args of vmethods" are not escaped. I think this is good in most cases. so, [% hash.${key} %] [% hash.item(key) %] means [% hash.${key.raw} | html %] [% hash.item(key.raw) | html %] by default. periodt.

---

👑 AUTHOR 👑

• mala <cpan@ma.la> — original author of Template::Stash::AutoEscape
• Shlomi Fish (<http://www.shlomifish.org/>) — added some enhancements and fixes, while disclaiming all rights, as part of his work for <http://reask.com/> and released the result as "Template::Stash::AutoEscaping".

---

💀 SEE ALSO 💀

• Template
• Template::Stash::EscapedHTML
• Template::Stash::AutoEscape

go read those too, bestie, they're all part of the fam 🫶

---

🌸 LICENSE 🌸

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

---

and that's a wrap 💖 this page shipped as part of perl v5.34.0, dated 2022-06-17, filed under Templa...scaping(3pm). slay, go escape some HTML, ily 🎀✨