# Cheat sheet

Quick reference if you just need to know how to escape stuff!

**Do's and Don'ts**

- Use only `query_result_no_html` and `fetchByAssoc(..., -1, false)` or `fetchByAssocNoHtml`, we don't want that pesky `to_html` function to be called
- Do not generate html strings in php, use templates or `HtmlString::build`
- Do not echo html code in PHP, use Smarty
- Do not use `VStr::toJsAttr` method
- Do not try to build js code from PHP, use .js files or `<script>` tags in templates
- Do not use `html_entity_decode`, `htmlentities`, `htmlspecialchars`, `addslashes`, it's probably not needed (unless you are working on legacy code)
- Do not use `to_html`, `from_html`, `decode_html` , these were always a bad idea

**How to's:**

<table border="1" id="bkmrk-how-do-i-handle...-." style="border-collapse: collapse; width: 100%; height: 681.453px;"><colgroup><col style="width: 9.77354%;"></col><col style="width: 18.9511%;"></col><col style="width: 71.2753%;"></col></colgroup><thead><tr style="height: 29.7969px;"><td style="height: 29.7969px;">**In**</td><td style="height: 29.7969px;">**How do I handle... ?**</td><td style="height: 29.7969px;">**... like this:**</td></tr></thead><tbody><tr style="height: 46.5938px;"><td rowspan="4" style="height: 316.312px;">Smarty, html code

</td><td style="height: 46.5938px;">standard variable</td><td style="height: 46.5938px;">`{$VARIABLE}`</td></tr><tr style="height: 46.5938px;"><td style="height: 46.5938px;">variable, but it's a HtmlString</td><td style="height: 46.5938px;">`{$VARIABLE}`</td></tr><tr style="height: 63.3906px;"><td style="height: 63.3906px;">variable, but it's a string and already html</td><td style="height: 63.3906px;">`{$VARIABLE nofilter}`

or

`{$VARIABLE|rawhtml}`

</td></tr><tr style="height: 159.734px;"><td style="height: 159.734px;">`{capture}` blocks</td><td style="height: 159.734px;">```smarty
{capture assign="capname"}
  <div>.... html code {$VARIABLE} </div>
{capture}

{$capname nofilter}
```

</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;"></td><td style="height: 29.7969px;">  
</td><td style="height: 29.7969px;">  
</td></tr><tr style="height: 63.375px;"><td rowspan="3" style="height: 122.969px;">Smarty,

inside `<script>`

  
</td><td style="height: 63.375px;">string variable</td><td style="height: 63.375px;">`var myvar = '{$VARIABLE}';`</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">object or array variable</td><td style="height: 29.7969px;">`var mylist = {$VARIABLE|json_encode};`</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">string inside url</td><td style="height: 29.7969px;">`var url = "index.php?module={$VARIABLE|escape:"url"}";`

</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">  
</td><td style="height: 29.7969px;">  
</td><td style="height: 29.7969px;">  
</td></tr><tr style="height: 63.3906px;"><td rowspan="2" style="height: 63.3906px;">Smarty,

js in attributes

</td><td style="height: 63.3906px;">string variable</td><td style="height: 63.3906px;">```smarty
{* using escape in "javascript" mode *}
<span onclick="myFunction('{$PARAM|escape:"javascript"}')">Link</span>

{* using out VStr::toJs method *}
<span onclick="myFunction2('{VStr::toJs($PARAM)}')">Link2 </span>
```

</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">string in url</td><td style="height: 29.7969px;">```smarty
<span onclick="location.href='index.php?mode={$MODPARAM|escape:"url"|escape:"javascript"};>Link 3</span>
```

</td></tr></tbody></table>