[BUG] Inconsistent behavior of Phalcon\Tag::setAutoescape()

\Phalcon\Tag::setAutoescape(false);
echo \Phalcon\Tag::textField(array('name', 'value' => '&"')), PHP_EOL;

\Phalcon\Tag::setAutoescape(true);
echo \Phalcon\Tag::textField(array('name', 'value' => '&"')), PHP_EOL;

\Phalcon\Tag::setDefault('name', '&"');

\Phalcon\Tag::setAutoescape(false);
echo \Phalcon\Tag::textField(array('name')), PHP_EOL;

\Phalcon\Tag::setAutoescape(true);
echo \Phalcon\Tag::textField(array('name')), PHP_EOL;

produces

<input type="text" value="&amp;&quot;" name="name" id="name" />
<input type="text" value="&amp;&quot;" name="name" id="name" />
<input type="text" name="name" id="name" value="&amp;&quot;" />
<input type="text" name="name" id="name" value="&amp;#x26;&amp;#x22;" />

value is escaped due to the bug introduced in a462ba2

However, the real issue is that Phalcon\Tag::getValue() only escapes the value when it is set either by setDefault() or is present in $_POST; if the value was specified in $params array it is NOT escaped by getValue() regardless of _autoEscape.

In the second case I would expect to see

<input type="text" value="&amp;amp;&amp;quot;" name="name" id="name" />

Currently getValue()'s logic is as follows:

function getValue($name, array $params)
{
    if (isset(self::$_displayValues[$name])) {
        $value = self::$_displayValues[$name]
    }
    else if (isset($_POST[$name])) {
        $value = $_POST[$name];
    }
    else {
        return null;
    }

    //...
}

I suggest that we check the value in the following order:

1. $params[$name]
2. self::$_displayValues[$name]
3. $_POST[$name]

In this scenario we will always honor autoEscape mode.

Yes, when $params[$name] is set getValue is never called so the order is the same. This is ok, are you going to remove the escaping in getValue()?

Changes:

• attributes are escaped only if autoescape is true
• getValue() checks first $params, then $_displayValues, then $_POST
• there is a dedicated function that escapes attributes;
• getValue() does not escape anything anymore