Magento 2 – Understanding @escapeNotVerified

magento2template

I see a lot of occurences of this comment /* @escapeNotVerified */ in the template files for Magento2.
Does it have a special meaning?
Is there any use for this?

Examples:

Best Answer

This tag is used by static tests. Any potentially unsafe output must be marked with either @escapeNotVerified or @noEscape to pass tests, the latter means that this particular usage has been checked and is safe.

In the future releases all occurrences of @escapeNotVerified will be verified and either marked with @noEscape or escaped with one of these methods:

  • \Magento\Framework\View\Element\AbstractBlock::escapeHtml
  • \Magento\Framework\View\Element\AbstractBlock::escapeUrl
  • \Magento\Framework\View\Element\AbstractBlock::escapeXssInUrl
  • \Magento\Framework\View\Element\AbstractBlock::escapeQuote

Also note that some output is considered safe and should not be marked with such annotations:

  • Enclosed in single quotes
  • Enclosed in double quotes but without variables
  • Type casting to bool, int
  • Method calls which contain 'html' in their names, like getTitleHtml, are also expected to output escaped HTML
Related Topic