Escaping deserved its own delimiter

Views gained a third interpolation form: {[ ... ]} outputs its value HTML-escaped.

Phlo already had two, and both are raw on purpose. {{ ... }} prints an expression, {( ... )} prints an inline conditional, and views compose HTML, so raw output is the useful default: a method returning a rendered table has to arrive as a table. The cost is that escaping was a thing you remembered, written as {{ esc($comment) }} on every line carrying text somebody else typed.

Remembering does not scale. The honest fix was not to escape everything, which breaks every view that legitimately returns markup, but to make the safe form as short as the unsafe one:

<p>{[ $comment ]}</p>
<p>{{ $this->renderedTable }}</p>

Now the choice is visible in the delimiter itself. Reviewing a view means looking at the brackets rather than tracing where a value came from, and reaching for the safe one costs no more typing than the raw one.

The rule of thumb: use {[ ]} whenever a value could contain characters a browser would read as markup, and keep {{ }} for values you have already made safe. Attributes in the head of a page are a good example of the first case, which is why the seo resource writes the page title and the canonical URL through the escaping form.

Engine 1.0.1. See interpolation in the Views chapter.