Problem
Much of the elegance of sfForm is skewed when using it with output escapers. Most notably:
- When echoing out a form, the form HTML is escaped.
- sfOutputEscaperObjectDecorator does not implement the ArrayAccess? interface, so we cannot do:
echo $form['username'];
we instead must do:
echo $form->offsetGet('username');
There are three possible options (from Fabien):
Solution 1
The easiest way to do this is to wrap safe variables within a special
object when passing a variable to the template:
$this->form = new sfOutputEscaperSafeVariable(new SomeForm()); // we need to come up with a better name
We can also create a shortcut function:
$this->form = mark_safe(new SomeForm()); // or markSafe()
Then the escaper just unwrap such objects and does not escape them.
Solution 2
The other possibility is to have a new method in the escaper classes to
add safe variables. So, in an action, you can do:
$this->a = 1; // which is equivalent to $this->setVar('a', 1);
or if you want to add a safe variable:
$this->setSafeVar('form', new sfForm());
This is perhaps faster than solution 1 but you can't use the $this-> convention for safe variables.
Solution 3
A third possibility is to have a special convention for classes that
don't need to be escape:
class SomeClass
{
const SF_IS_SAFE = true; // again, we need a better name
// or
public function isHtmlSafe()
{
return true;
}
}
But this does not work if you use third party classes.
