Security · Question 8 of 12
A visitor enters <script>alert(1)</script> as their name, and the Fluid template outputs it with {name}. What happens?
1 answer is correct. Easy
Show answer
Answer
- C The text appears visibly on the page, because Fluid escapes the angle brackets
Explanation
Fluid automatically escapes variables such as {name} with htmlspecialchars() on output: <script> becomes <script>, and the browser displays the characters as text instead of interpreting them as HTML. This automatic escaping is the most important protection against cross-site scripting (XSS) in TYPO3 templates. It no longer applies if you output the value with <f:format.raw> or {name -> f:format.raw()}, which you should never do with user input. Fluid does not delete the content and does not throw an error either; the value is kept, it is just made harmless.