It would be nice, if by default, if an array is passed to set_global, the third parameter of set_global could also be an array, so that encoding could be turned on/off for each key => value pair. I like to turn auto_encoding off in my config, but if I use set_global with an array, in it's current state the method will either encode all or leave all as is. Yes, extending the method is easy, but it should also be easy to implement in the core. No, I'm not interested in providing a pull request, as I am still just "playing" with Fuel.
I know the View class is almost a copy of Kohana's view class. Kohana doesn't have the auto encoding, and to me the auto encoding is a little bit of a pain in the ass. While nested views are not encoded, which is good, if I have a little snippet of HTML in my array passed to set_value, I have to deal with this auto encoding malfunction.
That is exactly the idea.
When you don't want encoding for a variable, you have to make a conscious effort to disable it. So you know you are disabling security for that variable. Globally disabling it is a very bad idea.
Instead, utilize the whitelist, and pass View objects to set() or set_global() if you want to include HTML. They will not be encoded.
The only valid reason for disabling encoding on a set() or set_global() is if you have some piece of dynamic HTML (for example from the database), in which case you have to use the third parameter, and you as a developer know that you specifically disabled encoding for that variable. For that reason it should be a separate method call, clearly documented why encoding is disabled. It should not be hidden in an array of with you encode everything but one value...
Donate
