Symfony2 HTML in the trans twig filter

Mikhail picture Mikhail · Nov 22, 2012 · Viewed 15.2k times · Source

I use the Symfony2.1 and have the default config.yml

Documentation said:

  {# but static strings are never escaped #}
  {{ '<h3>foo</h3>'|trans }}

But if I copy and paste it into the my empty template (without any additional autoescapes or another) I got the escaped string <h3>foo</h3>. What I do wrong?

Answer

redbirdo picture redbirdo · Nov 22, 2012

Try it with the twig raw filter:

{{ '<h3>foo</h3>' | trans | raw }}

However, do not use the raw filter if you are processing any user input! It allows for cross-site-scripting attacks, according to the creators of Symfony. See this similar question for a secure but more tedious alternative.