diff --git a/src/View.php b/src/View.php
index ef2796af..55e80a67 100755
--- a/src/View.php
+++ b/src/View.php
@@ -77,12 +77,16 @@ public function __construct(string $path = '')
*
* @throws Exception
*/
- public function setParam(string $key, mixed $value): static
+ public function setParam(string $key, mixed $value, bool $escapeHtml = true): static
{
if (\strpos($key, '.') !== false) {
throw new Exception('$key can\'t contain a dot "." character');
}
+ if (is_string($value) && $escapeHtml) {
+ $value = \htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
+ }
+
$this->params[$key] = $value;
return $this;
diff --git a/tests/ViewTest.php b/tests/ViewTest.php
index 9b18fb1e..e21131af 100755
--- a/tests/ViewTest.php
+++ b/tests/ViewTest.php
@@ -83,4 +83,10 @@ public function testCanFilterNewLinesToParagraphs()
{
$this->assertEquals('line1
line2
', $this->view->print("line1\n\nline2", View::FILTER_NL2P));
}
+
+ public function testCanSetParamWithEscapedHtml()
+ {
+ $this->view->setParam('key', 'value');
+ $this->assertEquals('<html>value</html>', $this->view->getParam('key', 'default'));
+ }
}