Drupal 8 Module Development

Sanitization methods in Drupal 8

Twig auto-escapes any string that is outputted using the normal notation, as follows:

{{ variable_name }}

However, there are cases in which the variable has already been marked safe, and Twig does not escape it anymore. This is usually in the case of MarkupInterface objects--such as FilteredMarkup or FormattableMarkup--we saw in Chapter 12, JavaScript and the Ajax API, when we discussed translations (extended by TranslatableMarkup). In these cases, Twig assumes that the strings they wrap have already been sanitized and that they can be outputted as they are. Of course, it is then up to us, as module developers, to ensure that we don't use any such objects with strings that contain an unsanitized user input. ...