In Anqi CMS, the flexible content model is one of its core strengths, which allows us to create various custom fields according to specific business needs.When handling the data output of these custom fields, we sometimes encounter situations where it is necessary to escape specific characters so that the data can be displayed in the expected way on the front end or interact correctly with scripts such as JavaScript.addslashesThe filter is a powerful tool provided to solve such problems.

Understand the custom fields and their output of AnQi CMS.

The AnQi CMS allows us to define exclusive custom fields for different content models (such as articles, products, etc.)These fields can be single-line text, multi-line text, numbers, options, and many other types, greatly enriching the expression of content.In the template, we can go througharchiveDetailTag or inarchiveParamsAccess the values of these custom fields in the loop.

For example, if we define a custom multi-line text field named "Product Description" for a "Product" content model, the field it calls isproductDescriptionThen in the product detail page template, we can get and output its value like this:

{% archiveDetail productDesc with name="productDescription" %}
<p>{{ productDesc }}</p>

WhenproductDescWhen the content contains special characters, such as single quotes, double quotes, or backslashes, if we want these characters to retain their literal meaning in a specific context rather than being interpreted as part of the code, we need to use escaping.

RevelationaddslashesFilter

addslashesThe filter is a practical feature provided by Anqi CMS template engine, mainly used to define characters in a string (including single quotes', double quotes"and backslash\Backslash before it. This is very useful in many scenarios, especially when we need to safely embed strings containing these special characters into other string literals, such as declaring a string variable in JavaScript.

The usage of this filter is concise and clear, simply through the pipe|Apply it after the variable to be processed:{{ 变量名|addslashes }}.

addslashesHow to apply the filter to custom field output?

The answer is affirmative,addslashesThe filter can be fully applied to the output of AnQi CMS custom fields. Its application method is the same as that of any other string variable.

Assuming our custom fieldproductDescriptionStored such content:这是一件带有"防水"功能的'户外'产品，材质是\尼龙\。It may cause syntax errors if output directly, for example, when used directly as a JavaScript string assignment.

To safely reference the content of this custom field in JavaScript, we can do it like this:

{% archiveDetail productDesc with name="productDescription" %}
<script>
    var productInfo = "{{ productDesc|addslashes|safe }}";
    console.log(productInfo);
</script>

Here, productDesc|addslashesIt will add a backslash before the double quotes, single quotes, and backslashes in the string, making it这是一件带有\"防水\"功能的\'户外\'产品，材质是\\尼龙\\。.

Following that|safeFilters are also crucial. The template engine of Anqi CMS defaults to escaping HTML entities in output content to prevent XSS attacks. If there is no|safe,addslashesThe backslash added by the filter may also be escaped&bsol;as HTML entities, which is not the result we want.|safeThe filter tells the template engine that the string is already safe and does not require additional HTML entity escaping, and should be output as is.This, after processing, the string can be parsed as a valid JavaScript string literal.

Consideration of practical application scenarios.

addslashesThe filter is not used for displaying general HTML content. In most cases, the default HTML entity escaping function of the Anqi CMS template engine (i.e., it is not necessary to use it explicitlysafe）Can ensure that the custom field content is displayed safely in the HTML page.addslashesIs more aimed at the following specific scenarios:

  1. Embedding JavaScript strings:When you need to embed the content of a custom field as a string directly into the page<script>within the tag,addslashesyou can ensure that quotes and backslashes do not break the JavaScript syntax.
  2. Build URL parameters:In some special cases, if the value of a custom field needs to be part of the URL and may contain characters that need to be escaped,addslashesMay provide preliminary processing (but it is recommended to useurlencodespecial URL encoding filters).
  3. for other backend or specific data format integration:When the value of a custom field needs to be passed to an API interface or a specific data format (such as some old versions of JSON or custom protocols), if the format has special escape requirements for quotes or backslashes,addslashesIt may come in handy.

Points to note

AlthoughaddslashesFilters are very useful in certain scenarios, but they are not a universal security solution. They only handle a few types of character escaping.

  • Security is notaddslashesthe primary responsibility of: addslashesIt is mainly used for syntax compatibility of string literals, rather than preventing all forms of injection attacks (such as XSS).Regarding the security of user input in custom fields, it should be validated and cleaned when inputting the content and rely on the default HTML entity escaping of the template engine when outputting to HTML.
  • Use with caution.|safe: |safeThe filter will disable the automatic HTML entity encoding feature of the template engine.Only when you are sure that the content has been properly secured and needs to be output in raw HTML format should you use it.incorrectly used|safeIt may introduce XSS vulnerabilities.
  • Choose the appropriate filter:In different application scenarios, there are more professional filters available. For example, if the goal is to safely embed content into HTML attributes, it may be necessaryescapeFilter; if the target is to be used as a URL parameter, thenurlencodeis the better choice.

In summary, the custom field output of Anqi CMS can be perfectly matched withaddslashesFilter usage, this provides the necessary flexibility in specific data processing scenarios. The key is to understand its mechanism of action and combine|safeFilter and consider the security requirements of different scenarios to make wise choices.

Frequently Asked Questions (FAQ)

Q1:addslashesFilters andescapeWhat are the differences between filters?A1:addslashesIt is mainly used to add a backslash before single quotes, double quotes, and backslashes, often used to construct JavaScript string literals or SQL query strings (although SQL should use the database's built-in escaping functions). Andescape(or its aliase）is used to represent HTML special characters such as</>/&/"/'Convert to HTML entity to prevent the browser from parsing the content as HTML, thus avoiding XSS attacks, which is a common security measure when outputting user content to an HTML page.

Q2: When should oneaddslashesafter using|safeFilter?A2: When you useaddslashesProcessed string, it needs to be embedded in the HTML context in its original form (without the backslashes being further escaped into HTML entities), usually followed by|safeFor example, willaddslashesThe processed content as a JavaScript variable value or HTMLdata-*attribute value|safeEnsure that backslashes are not escaped twice. But please remember to use|safeThis will disable the automatic HTML entity escaping in the template engine, which means you must ensure that the content has been thoroughly checked for security.

Q3: Can I directly write HTML tags in the custom field content? Will Anqi CMS automatically handle it?A3: You can certainly write HTML tags in the content of custom fields.In Anqi CMS, if the content type of a custom field is a rich text editor (such as a Markdown editor), it is usually stored in HTML format.When you output these fields in the template, the default behavior of the Anqi CMS template engine is to perform HTML entity escaping, which will convert HTML tags (such as<p>Converted to `&lt;p&