In AnQiCMS template development, we often need to handle various strings, including strings with special characters. How to safely and correctly pass and display these strings in different environments is a detailed consideration issue.addslashesThe filter is designed to solve such specific scenarios.

What isaddslashesFilter?

addslashesThe filter is a string processing tool provided by the AnQiCMS template engine. Its main function is to add a backslash before the 'predefined characters' in a string.\）进行转义。这些被视为特殊、需要预处理的字符包括：

  • 单引号 (')
  • 双引号 (")
  • 反斜杠 (\)

例如，如果您的字符串是"安企"CMS""afteraddslashesAfter processing, it may become"安企\\"CMS\\""This process is to ensure that these special characters are not misinterpreted in specific data formats or script environments, thereby maintaining the integrity of the data and the correctness of the script.

Why is it necessary to useaddslashes?

Imagine you are building a website and need to pass a text content containing special characters (such as single quotes or double quotes) to a JavaScript function on the frontend, or as an HTML element'sdata-Property value. If these special characters are not properly escaped, it may lead to:

  1. JavaScript syntax error:An unescaped single quote may prematurely terminate a JavaScript string, causing subsequent code parsing failure or execution exception. For example:alert('这是'一个'测试');This will cause a syntax error.
  2. Data parsing issue: When embedding string content as JSON data in HTML, or in other scenarios requiring strict formatting, unescaped special characters may disrupt the data structure.
  3. Safety hazard:AlthoughaddslashesMainly used for data formatting, but it also indirectly helps to avoid certain simple injection attacks, ensuring that data is parsed as expected.

Therefore, when you know for certain that a string content will be parsed by JavaScript, or embedded into a specific data format that requires this backslash escaping,addslashesThe filter becomes particularly important.

How to correctly use in AnQiCMS templateaddslashes?

Used in AnQiCMS templateaddslashesThe filter is very intuitive, its basic syntax is{{ 您的变量 | addslashes }}However, it is especially important to emphasize that in order to ensureaddslashesit can work as expected, you usually also need to use in conjunction with|safeFilter.

AnQiCMS template engine, for security considerations, defaults to escaping all output content. This means that it will escape some HTML special characters (such as<Converted to&lt;,"Converted to&quot;Processed to prevent cross-site scripting (XSS).

However,addslashesThe purpose of the filter is not to HTML-escape, but to ensure that quotes and backslashes in the string are 'preprocessed' in certain specific scenarios, so that they maintain their literal meaning during secondary parsing (such as being parsed by JavaScript). If not|safeEnglish, youraddslashesThe effect may be “cancelled out” or “over-processed” by the default HTML escaping function of AnQiCMS template engine：“

  • none|safe: {{ "安企\"CMS\"" | addslashes }}it may output安企&quot;CMS&quot;(Default HTML escaping, turning)\"of"Converted to&quot;，lostaddslasheseffect).
  • with|safe: {{ "安企\"CMS\"" | addslashes | safe }}to output what you expect.安企\\"CMS\\"where the backslashes before the double quotes are preserved and there is no additional HTML entity encoding.

Example of correct usage:

Assuming youritem.TitleVariable value is“安企”CMS“系统”do you want to display this title in thealertfunction in JavaScript:

<script>
    // 假设 item.Title 的值为： “安企”CMS“系统”
    // 经过 addslashes 处理后，它可能变为： “安企\”CMS\“系统”
    // 再通过 |safe 输出到 HTML，JavaScript 就能正确解析这个带转义引号的字符串了。
    alert('{{ item.Title | addslashes | safe }}');
</script>

Document provided example:

{# 假设我们有一个变量叫做 myString，其内容是 "安企\"CMS\"" #}
{{ "安企\"CMS\""|addslashes|safe }}
{# 显示结果：安企\\"CMS\\"" #}

{# 另一个示例：包含反斜杠和引号的字符串 #}
{{ "This is \\a Test. \"Yep\". 'Yep'."|addslashes|safe }}
{# 显示结果：This is \\\\a Test. \\"Yep\\". \\'Yep\\'. #}

In the above example, you will notice that the double quotes, single quotes, and backslashes in the string are all successfully escaped with backslashes, and because|safeThe presence, these backslashes are not encoded with additional HTML entities.

Precautions

  • The goal is clear: addslashesNot a general HTML security filter. If you just want to prevent XSS attacks, the default template engine escaping behavior is usually sufficient, or you should useescapeFilter.addslashesMore suitable for embedding strings safely into contexts that require backslash escaping (such as JavaScript strings or certain specific data formats).
  • Always with|safeCombining:In most casesaddslashesto prevent the default HTML escaping of the AnQiCMS template engine from “interfering”addslashesit is almost always necessary to use in conjunction with|safeFilter.
  • Test output:When usingaddslashesAfter the filter, it is recommended that you view the source code of the page to ensure that the output string meets your expectations, especially when it involves complex JavaScript interactions or data formats.

Correctly understand and useaddslashesFilter, which can help you handle string data in AnQiCMS templates more flexibly and safely, ensuring smooth front-end interaction and accurate data transmission.

Common Questions (FAQ)

1.addslashesfilters andescapeWhat are the differences between filters?

addslashesThe filter is used to add a backslash before single quotes, double quotes, and backslashes in a string. The main purpose is to prepare data formats that require this kind of escaping, such as JavaScript or other similar formats.escape(or the default auto-escaping) The filter is to convert HTML special characters (such as</>/&/"/') to HTML entities (such as&lt;/&gt;/&amp;/&quot;/&#39;），to prevent the browser from parsing it as HTML code, thereby avoiding XSS attacks and improving page security. The two have different goals and scenarios.

2. Why did I use a filter in the template?{{ 变量 | addslashes }}，but the quotes output are still&quot;Instead\"?

This is because the AnQiCMS template engine defaults to HTML-encoding all output content, which willaddslashesgenerated\"English quotes are escaped again&quot;to be retainedaddslashesThe effect of the filter, you need to explicitly tell the template engine that this content is "safe" and does not require additional HTML escaping. Therefore, the correct approach is to use|safeFilter:{{ 变量 | addslashes | safe }}.

3. When should I use itaddslashesWhen should I not use it?

You should use it in the following scenariosaddslashes:

  • Embed strings containing quotes or backslashes directly into the HTML JavaScript script block as JavaScript variables or function parameters.
  • Translate this string asdata-Attribute values, which will then be read and parsed by JavaScript.
  • Generate JSON strings directly in the template or other data formats that require strict backslash escaping.

You should not use the following scenarios.addslashes:

  • Display plain text directly on the HTML page (the default HTML escaping is sufficient and safe).
  • 仅仅为了防止 XSS 攻击（此时应该依赖默认的 HTML 转义或escapefilterer)。
  • 将字符串作为 HTML 属性值（如alt=""/title=""），此时通常只需要 HTML 转义，addslashes可能会引入不必要的反斜杠。