Disabled Auto Escape (ARCH7134)

Key php.security.disabled-auto-escape · Severity warning · Category security · CWE CWE-79

Turning off auto-escaping in a template engine such as Twig removes the default XSS protection for all rendered output. Writing untrusted data raw into HTML causes cross-site scripting.

Incorrect

<?php
$twig = new \Twig\Environment($loader, [
    'autoescape' => false, // all output unescaped
]);
echo $twig->render('profile.html', ['bio' => $userBio]);

Correct

<?php
$twig = new \Twig\Environment($loader, [
    'autoescape' => 'html',
]);
echo $twig->render('profile.html', ['bio' => $userBio]);

Fix

Keep auto-escaping enabled globally; use a local |raw only for genuinely required, sanitized fragments.