This unescaped output is fine here; other sniffs will complain about it though.
getSomeString(); ?>
getSomeString(); ?>
getSomeString(); ?>
getSomeString(); ?>
These should be using equivalent methods on the `$escaper` class, not the `$block` class.
Note that I couldn't find any use of this method in any templates within Magento.
escapeCss($block->getSomeString()); ?>
escapeHtml(__($block->getSomeString())) ?>
escapeHtml(__($block->getSomeString())); ?>
escapeHtml(__($block->getSomeString()), ['strong', 'em', 'span']) ?>
The only example of this method being used was in a block class, rather than a template.
getItems() as $item) {
$item['sku'] = $escaper->escapeJsQuote($item['sku']);
}
?>
The only example of this method being used was in a block class, rather than a template.
escapeQuote(__($block->getData('welcome'))); ?>
link text
Note that I couldn't find any use of this method in any templates within Magento.
escapeXssInUrl($block->getSomeString()); ?>
These are edge cases for formatting differences
escapeHtml('');
$escaper ->escapeHtml('');
$escaper-> escapeHtml('');
$escaper
->escapeHtml('');
$escaper
->escapeHtml('');
$escaper->
escapeHtml('');
$escaper-> // comment
escapeHtml('');
$escaper /* comment */
->escapeHtml('');
$escaper /* comment */ -> /* comment */ escapeHtml('');
?>
These close-matches shouldn't be flagged by this sniff.
escapeHTML(__($block->getSomeString())) ?>
escapeHtmlString(__($block->getSomeString())) ?>
escapeHtmlAttribute($block->getSomeString()) ?>
escapeCSS($block->getSomeString()); ?>
escapeJS($block->getData('html_id')) ?>
escapeJavaScript($block->getData('html_id')) ?>
escapeQuotes(__($block->getData('welcome'))); ?>
escapeURL($block->getUrl('adminhtml/notification/index')) ?>