1-33

Symfony2 – Franz Jordán 2011
{# src/Acme/BlogBundle/Resources/views/Blog/index.html.twig #}
{% extends 'AcmeBlogBundle::layout.html.twig' %}
{% block content %}
{% for entry in blog_entries %}
{{ entry.title }}
{{ entry.body }}
{% endfor %}
{% endblock %}
Notice that this template extends the section template -
(AcmeBlogBundle::layout.html.twig) which in-turn extends the base application layout
(::base.html.twig). This is the common three-level inheritance model.
When building your application, you may choose to follow this method or simply make each
page template extend the base application template directly
(e.g. {% extends '::base.html.twig' %}). The three-template model is a best-practice
method used by vendor bundles so that the base template for a bundle can be easily overridden
to properly extend your application's base layout.
Output Escaping
When generating HTML from a template, there is always a risk that a template variable may
output unintended HTML or dangerous client-side code. The result is that dynamic content
could break the HTML of the resulting page or allow a malicious user to perform a Cross Site
Scripting (XSS) attack. Consider this classic example:
Hello {{ name }}
Imagine that the user enters the following code as his/her name:
alert('hello!')
Without any output escaping, the resulting template will cause a JavaScript alert box to pop up:
Hello alert('hello!')
And while this seems harmless, if a user can get this far, that same user should also be able to
write JavaScript that performs malicious actions inside the secure area of an unknowing,
legitimate user.
The answer to the problem is output escaping. With output escaping on, the same template will
render harmlessly, and literally print the script tag to the screen:
Hello <script>alert('helloe')</script>
The Twig and PHP templating systems approach the problem in different ways. If you're using
Twig, output escaping is on by default and you're protected. In PHP, output escaping is not
automatic, meaning you'll need to manually escape where necessary.
Output Escaping in Twig
If you're using Twig templates, then output escaping is on by default. This means that you're
protected out-of-the-box from the unintentional consequences of user-submitted code. By
default, the output escaping assumes that content is being escaped for HTML output.
80