Login
< CMS Certified Integrator 14 LTS

Outputting and escaping variables in Fluid

TYPO3

Show in app

Description

Fluid templates receive variables and outputs them using a curly-brace syntax. This skill covers variable access, reserved names, dot notation, automatic escaping, Cross-Site-Scripting (XSS) risks, and the CDATA-based approach introduced in Fluid 5 (TYPO3 v14) to handle syntax collisions with inline CSS and JavaScript.

Goals

  • I know how to output a variable in a Fluid template using the `{variableName}` syntax and how to inspect available variables using the <f:debug> ViewHelper.
  • I know how to use dot notation to access array keys and object properties, including the fallback chain Fluid uses, and how to access values using a dynamic index `{myArray.{myIndex}}`.
  • I know which variable names are reserved in Fluid and those starting with Fluid 5 (TYPO3 v14).
  • I know that Fluid escapes all variable output by default using htmlspecialchars to prevent XSS attacks.
  • I know how to disable escaping using <f:format.raw> and I know the XSS risks this creates when outputting user-supplied or HTML-containing strings.
  • I know how CDATA sections behave in Fluid 5 (TYPO3 v14): variables require triple curly braces `{{{ }}}` and <f:comment> replaces CDATA for commenting out Fluid code.

Maintainer

Oliver Thiele Web Development Oliver Thiele