Creating a widget has a few important steps that should be followed.
quotes - should be used only if variable is enclosed within single quotes. For double quotes (e.g. HTML tag attributes) see 'html' modifier belowurlpathinfo - should be used it variable is part of the URLhtml - should be used if variable is included directly as part of HTML or as HTML tag parameter (e.g. enclosed in quotes "" - don't use 'quotes' modifier in this case!)If you need to combine escape modifier with other modifiers like default, you can separate them with a pipe like this:
Hello, <b><!--{$name|default:'guest'|escape:'html'}--></b>!
Widgets extension implements validate modifier that uses PHP Data filtering to allow validating widget parameters.
To make sure $homepage variable value is a valid URL, you can use following code:
<a href="<!--{$homepage|validate:url}-->">Homepage</a>
Following values for the validate are supported by Widgets extension (mapping to corresponding PHP's validation filters):
url (FILTER_VALIDATE_URL)int (FILTER_VALIDATE_INT)boolean (FILTER_VALIDATE_BOOLEAN)float (FILTER_VALIDATE_FLOAT)email (FILTER_VALIDATE_EMAIL)ip (FILTER_VALIDATE_IP)