What should I use to escape a module parameter in Joomla 5?

Question

I have a custom module I have created.

When writing the code Chat GPT suggested that I use this code.

use Joomla\CMS\Utilities\Utility;
~
echo "<p><strong>" . Utility::escape($review['author_name']) . "</strong></p>";

However, that didn't work. There's a stack error with utility.

It then suggested that I use:

use Joomla\CMS\HTML\HTMLHelper;
~
 echo "<p><strong>" . HTMLHelper::_('text', $review['author_name']) . "</strong></p>";

Which again didn't work. It says that text does not exist.

It then suggested I use:

echo "<p><strong>" . htmlspecialchars($review['author_name']) . "</strong></p>";

Which I felt was the old way of doing things, utility seemed like the new way.

Is there a preferred way to do this. Someone said HTML Entities although looking at it htmlspecialchars should be ok in most instances I think.

I really wanted to know if there's a difference, why my code didn't work, and what is best practice. Or what the differences are.

Answer 1

The proposed methods don't work simply because they don't exist. htmlspecialchars() is fine. There is no generic utility method because it would really just be a proxy to htmlspecialchars(). For completeness, HTML views and JLayouts do have an escape() method (Joomla\CMS\MVC\View\HtmlView::escape() and Joomla\CMS\Layout\BaseLayout::escape(), respectively). But again they're just proxies to htmlspecialchars().