What do $this->escape() in zend framework actually do?

Question

I need help in understanding the actual actions of a helper function in Zend Framework.

I need someone to explain to me what $this->escape($string) actually does to the string passed to it before printing the string into the template.

Answer 1

$this->escape() escapes a string according to settings you can provide with $this->setEscape('functionname'), by default it is PHP's htmlspecialchars function.

http://framework.zend.com/manual/en/zend.view.scripts.html

Answer 2

It calls the htmlspecialchars PHP function.

The translations performed are:

• '&' (ampersand) becomes '&'
• '"' (double quote) becomes '"'
• '<' (less than) becomes '&lt;'
• '>' (greater than) becomes '&gt;'

Answer 3

Over at the PiKe project we build a custom stream wrapper that automatically escapes all view variables to be safe by default against XSS, with a MINIMAL performance hit! You can still get the RAW value with:

<?=~ $variable ?>

Notice the "~" character. Checkout http://code.google.com/p/php-pike/wiki/Pike_View_Stream