When should I use $sanitizer vs field text formatters in ProcessWire?

[zilli]

Hi all,

I think I’m mixing up some concepts and would appreciate some clarification about when to use $sanitizer vs field text formatters.

For example, I have a title field that already uses the text formatter “HTML Entity Encoder (htmlspecialchars)”.

In that case, do I still need to escape it manually on output, like this?

<title id="html-title" pw-replace><?= $sanitizer->entities($page->title) ?></title>

Or should I assume that the formatter already makes it safe for HTML output, and avoid double-escaping?

More generally:

• When is $sanitizer mainly intended to be used?

• On input, on output, or both?

[monollonom]

As long as the output formatting is on you can assume your "$page->title" will return a formatted value and so in your case with the entities encoded thanks to the Textformatter. So no need to escape it again using $sanitizer.

$sanitizer is mostly here to clean inputs from user-submitted forms or more broadly whenever you have to save external data you don't have control over.

[zilli]

Thanks @monollonom