v2.12.10

Enhancements: raw() (PR #84)

• raw(): A new global function, the opposite of h(): it returns a value as it is, as a string, to print HTML without escaping on purpose, e.g. <?= raw($bodyHtml) ?>. It marks the places that print unescaped HTML, so that they can be found and reviewed; pieceofcake2/security-sast lists them. It takes a string, a number, a boolean, null (an empty string) or an object with __toString(), and throws InvalidArgumentException for an array. As the other global functions, it is defined only when no function of that name exists

Upgrading

composer update pieceofcake2/cakephp

Nothing changes for an application that does not call raw(). An application or a package that already defines a global raw() keeps its own function, as for the other global functions of CakePHP: check that it does the same, or rename it. See UPGRADE.md and raw().

pieceofcake2/security-sast 1.0.5 lists the HTML printed with raw() as information.