I think we should use the following security settings: escaping-strategy: on & csrf-secret

[jzarate]

r230 csrf protection in invoice editing.

[jzarate]

r235 escaping strategy ON.

NOTE TO OTHERS: when including partials, the variables that are passed through the companion array, are also escaped , and that can produce double-escaping sometimes (if you pass a variable which comes from the action and has been already escaped).

it's described here:

http://trac.symfony-project.org/ticket/509

The solution is here:

http://trac.symfony-project.org/ticket/3215

in the particular case of forms,

<?php echo  $form['inputName'] ?>

when called inside an included php fragment, using a variable passed to it through the companion array, no longer render proper input fields, it escapes them.

the solution is to use the overcharged method render() instead

<?php echo $form['inputName']->render(ESC_RAW)?>