Templating best practices

Type hinting

Add the type hinting using the @var tag at the beginning of the template file.

<?php /** @var Core_Page $this */ ?>

<?php /** @var Core_Block $this */ ?>

URL

Always use the getUrl method to build internal links, with the link path as an argument. This secures the link.

Pass the route path without the leading slash used in the route declaration: getUrl('contact.html') targets the route declared as '/contact.html', and getUrl('contact/post/') targets '/contact/post/'.

<a href="<?= $this->getUrl('page.html') ?>">My Page</a>

<a href="<?= $this->getUrl('page.html') ?>#contact">My Page</a>

<a href="<?= $this->getUrl('download/invoice', ['id' => 1]) ?>">Download</a>

<a href="<?= $this->getUrl('customer.html', ['id' => 1]) ?>">My Account</a>

Escape

Always escape variables from internal methods.

App::escapeHtml : escape content that will be rendered within HTML tags
App::escapeHtmlAttr : escape data that will be placed within HTML element attributes
App::escaper()->escapeQuotes : escape single quotation marks in a string by prefixing them with a backslash

<p><?= App::escapeHtml($this->getWelcomeText()) ?></p>

<p class="<?= App::escapeHtmlAttr($this->getClassName()) ?>">My Text</p>

<a href="#" onclick="alert('<?= App::escaper()->escapeQuotes("that's true") ?>')">Alert</a>