HtmlPrinter

MMO\core\printers · 1 symbol · generated 5 Oct 2026

class

HtmlPrinter

A TextPrinter for HTML output: the same templates as HTML markup instead of plain text -- used both for a document's inline "server console" log block (HtmlDocument) and for HTML dump output.

class MMO\core\printers\HtmlPrinter extends MMO\core\printers\TextPrinter

Namespace: MMO\core\printers
Extends: TextPrinter

What the value printed holds as text (a log's message and backtrace, a dump's keys...) is always HTML-escaped ([`renderText`](https://mcp.mmoframework.fr/documentation/mmo.core/php/printers/HtmlPrinter.md#htmlprinter-rendertext)).

echo HtmlPrinter::Print($someObject, ['dump' => true]);

Index

	globalOptions
	templates
	exportFilename($value, $options)	NOTE: this used to build the `<a href="php://...">...</a>` tag by concatenating $value and its relativized form directly into the HTML, with no escaping at all -- a filename containing e.g.
	exportRenderable($value, $options)	Same as `TextPrinter::exportRenderable`, except that `escape` does not reach what a `<script>` or a `<style>` holds (such as the source `HtmlDocument::addInlineScript` put…
	exportString($value, $options)	A string is printed AS IS by default -- it is how an HTML document embeds markup (e.g.
	renderMaxLevel($value, $options)	Same as `TextPrinter::renderMaxLevel`, HTML-escaped.
	renderText($text)	Same as `TextPrinter::renderText`, HTML-escaped whatever `escape` says: the keys of a dump, a resource's uri, a validation error's message, a log's message and backtrace are text, so a dump of a…

Properties2

globalOptions

array $globalOptions = []

Type: array

templates

protected array $templates = […36 items]

Type: array

Methods5

exportFilename($value, $options)

HtmlPrinter.php:70

NOTE: this used to build the <a href="php://...">...</a> tag by concatenating $value and its relativized form directly into the HTML, with no escaping at all -- a filename containing e.g. "><script>... broke out of the href attribute and injected arbitrary markup/script into the page. Fixed to escape both the attribute value and the link text.

function exportFilename(mixed $value, array $options = []): string

$value	mixed
$options = []	array
returns	string

exportRenderable($value, $options)

HtmlPrinter.php:116

Same as TextPrinter::exportRenderable, except that escape does not reach what a <script> or a <style> holds (such as the source HtmlDocument::addInlineScript puts there): it is not HTML, the browser decodes no entity in it, so escaped, if (a && b) would come out as a broken if (a && b).

function exportRenderable(MMO\core\interfaces\iRenderable $value, array $options = []): string

$value	iRenderable
$options = []	array
returns	string

$page = new HtmlDocument(null, new DocumentOptions(print: new PrintOptions(escape: true))); $page->addInlineScript('if (a && b) {go();}'); // printed as it is, where the page's other strings are escaped

exportString($value, $options)

HtmlPrinter.php:93

A string is printed AS IS by default -- it is how an HTML document embeds markup (e.g. the strings an XmlNode holds, such as the source HtmlDocument::addInlineScript puts in a <script>), so escaping every string would break that.

function exportString(mixed $value, array $options = []): string

**That makes any untrusted string printed through here an XSS**: a visitor's comment holding an `<img onerror=...>` renders that tag live. Pass `'escape' => true` (per call, or in [`$globalOptions`](https://mcp.mmoframework.fr/documentation/mmo.core/php/printers/HtmlPrinter.md#htmlprinter-globaloptions) for a printer that never embeds markup) to have strings HTML-escaped instead. The dump branch always escapes. A log is not printed through here: its message and backtrace are always escaped ([`renderText`](https://mcp.mmoframework.fr/documentation/mmo.core/php/printers/HtmlPrinter.md#htmlprinter-rendertext)), whatever `escape` says.

$value	mixed
$options = []	array	`dump` (bool) debug rendering, `escape` (bool) HTML-escape the string
returns	string

HtmlPrinter::Print('<b>hi</b>'); // '<b>hi</b>' -- markup, on purpose

HtmlPrinter::Print('<b>hi</b>', ['escape' => true]); // '<b>hi</b>'

renderMaxLevel($value, $options)

HtmlPrinter.php:128

Same as TextPrinter::renderMaxLevel, HTML-escaped.

function renderMaxLevel(mixed $value, array $options = []): string

$value	mixed
$options = []	array
returns	string

renderText($text)

HtmlPrinter.php:140

Same as TextPrinter::renderText, HTML-escaped whatever escape says: the keys of a dump, a resource's uri, a validation error's message, a log's message and backtrace are text, so a dump of a request body keyed <img onerror=...>, or a log quoting one of its keys, must not render that tag in the page.

protected function renderText(string $text): string

$text	string
returns	string

$this->renderText('<img src=x>'); // '<img src=x>'

Inherited members (96)

Constants	Declared by	Description
`ALERT`	iLogLevel	Alert: Action must be taken immediately.
`ALL`	iLogLevel	Mask for all
`ALL_PLUS`	iLogLevel	debug everything
`BACKTRACE`	iLogLevel
`CRITICAL`	iLogLevel	Critical: Critical conditions.
`DEBUG`	iLogLevel	Debug: Detailed debug information.
`DEEP`	iLogLevel	debug everything with arguments
`EMERGENCY`	iLogLevel	Emergency: System is unusable.
`ERROR`	iLogLevel	Error: Runtime errors that do not require immediate action but should typically be logged and monitored.
`ERROR_PLUS`	iLogLevel	Mask for all error
`FATAL`	iLogLevel	Mask for all fatal error
`INFO`	iLogLevel	Info: Interesting events.
`INFO_PLUS`	iLogLevel	Mask for all errors/warning/notices/info
`MEMORY`	iLogLevel	include backtrace object
`NOTICE`	iLogLevel	Notice: Normal but significant events.
`NOTICE_PLUS`	iLogLevel	Mask for all errors/warning/notices/info
`TRACE`	iLogLevel	include backtrace as origins
`WARNING`	iLogLevel	Warning: Exceptional occurrences that are not errors.
`WARNING_PLUS`	iLogLevel	Mask for all errors and warnings

	Properties	Declared by	Description
	`functions`	aConverter
	`verbosity`	aModule

Methods	Declared by	Description
`addOptions($type, $options)`	aConverter	Merge $options into $type's existing options (via `merge`), rather than replacing them wholesale like `setOptions`.
`alert($message, $context)`	aModule	Action must be taken immediately.
`backtraces($message, $context)`	aModule	Force-log a message at INFO level together with a full stack trace/memory snapshot (`iLogLevel::BACKTRACE`), bypassing the verbosity mask entirely (any non-zero verbosity is enough to trigger it).
`call($type, $value, $options)`	aConverter	Call the function associated to a type
`clear()`	TextPrinter	Reset both the exporter state (`aExporter::clear`) and `$templates`.
`Configure($config)`	aModule	Merge $config into this module's configuration in the shared `Configuration`.
`critical($message, $context)`	aModule	Critical conditions. No-op if CRITICAL is currently filtered out by the verbosity mask.
`debug($message, $context)`	aModule	Detailed debug information.
`debugName()`	aModule	Human-readable identifier used as the default `{origin}` in this instance's log messages.
`DefaultConfig()`	aModule	The config a module starts from before anything loaded via `Configuration` is merged in.
`dump($values)`	TextPrinter	Echo one or more values in dump mode (see `idump`), with a header naming the calling file/line and a footer.
`emergency($message, $context)`	aModule	System is unusable. No-op if EMERGENCY is currently filtered out by the verbosity mask.
`error($message, $context)`	aModule	Runtime errors that do not require immediate action but should typically be logged and monitored.
`Export($value, $options, $type)`	aExporter	Export any value, dispatching to the right converter based on its type (or the explicit $type).
`exportArray($value, $options)`	aExporter	Built-in 'array' converter (a list): recursively exports every value, in place.
`exportBoolean($value, $options)`	TextPrinter	Typecast to a boolean and return template 'true' or 'false'
`exportClosure($value, $options)`	TextPrinter	Closure
`exportDateTime($value, $options)`	TextPrinter	Render a DatimeInterface
`exportDump($value, $options)`	TextPrinter	The 'dump' type exporter -- same as `idump` but registered for explicit dispatch via `__invoke($v, [], 'dump')`.
`exportEntity($value, $options)`	TextPrinter	An entity (any `iArrayProperties`) is printed as its toArray() -- what an API returns of it -- the same as
`exportEnum($value, $options)`	TextPrinter
`exportInstance($value, $options)`	TextPrinter	object options: - {int} scope: binary combinaison of the class constants PROPERTY_*.
`exportLog($value, $options)`	TextPrinter	MMO\core\events\Log
`exportNull($value, $options)`	TextPrinter	Return template 'null'
`exportNumber($value, $options)`	TextPrinter	Format number
`exportObject($value, $options)`	TextPrinter	array options: {HashList} hashes: the hash list {int\|false} max-level: the max level to go to.
`ExportProperties($value, $options)`	aExporter	Export an object `exportInstance` method
`exportResource($value, $options)`	TextPrinter	Resource
`exportSplObjectStorage($value, $options)`	TextPrinter
`exportsProperty($prop, $value)`	TextPrinter	Same as `aExporter::exportsProperty`, and a property marked #[NoDump] (a back-reference, such as a collection's repository) is not printed either: an object is printed without what its dump leav…
`exportThrowable($value, $options)`	TextPrinter
`exportTraces($value, $options)`	TextPrinter	MMO\core\messages\Log::traces
`exportValidatorError($value, $options)`	TextPrinter
`getClassFunction($class)`	aConverter	Find which registered type (a class or interface name) applies to $class: itself if directly registered, else the closest registered ancestor class or implemented interface.
`getFunction($type)`	aConverter
`getFunctions()`	aConverter
`getIndent($options)`	TextPrinter
`getOptions($type)`	aConverter
`getTemplate($name)`	TextPrinter
`getTemplates()`	TextPrinter
`getType($value, $allowClass)`	aConverter	Normalize $value's type into one of this converter's type names.
`getVerbosity()`	aModule
`hash($value, $options)`	TextPrinter
`hasTemplate($name)`	TextPrinter
`hasType($type)`	aConverter
`hiddenProperties($value)`	TextPrinter	The properties of $value whose value a dump does not show (`exportInstance`): for an `iArrayProperties` (an entity), those behind a hidden ArrayProperty (`ArrayProper…`
`idump($value, $options)`	TextPrinter
`info($message, $context)`	aModule	Interesting events. No-op if INFO is currently filtered out by the verbosity mask.
`Instantiate($config)`	aModule	(Re)create the shared instance immediately, configured with $config merged into the class's existing config.
`IsShared()`	aModule
`log($level, $message, $context)`	aModule	Logs with an arbitrary level.
`notice($message, $context)`	aModule	Normal but significant events.
`offsetExists($key)`	aModule	\ArrayAccess::offsetExists -- tells whether $key is a declared property at all, regardless of whether it is currently readable/writable through array access.
`offsetGet($key)`	aModule	\ArrayAccess::offsetGet -- reads a property directly, unless it has a `#[Serialize(serialize: 'methodName')]` attribute, in which case that zero-argument method is called instead (e.g.
`offsetSet($key, $value)`	aModule	\ArrayAccess::offsetSet -- sets a property directly, unless it has a `#[Serialize(unserialize: 'methodName')]` attribute, in which case that method is called with $value instead (e.g.
`offsetUnset($key)`	aModule	\ArrayAccess::offsetUnset -- equivalent to `$module[$key] = null`.
`Print($value, $options, $type)`	TextPrinter
`renderPrintError($e)`	TextPrinter	What a value whose exporter threw is printed as (`__invoke`): the exception's class and message, as text (`renderText`) -- never its stack trace.
`renderTemplate($name, $data)`	TextPrinter	Render a template
`resetHash($value, $options)`	aExporter	Forget that $value was already seen, within the given $options['hashes'] tracking map: the next time $value is encountered in this same export, it is exported in full again instead of collapsing to…
`serialize($path, $serializer)`	aModule	\MMO\core\interfaces\iSerializable::serialize -- exports every property (via
`setFunction($type, $fn, $options)`	aConverter	Set a coercer
`setFunctions($fns)`	aConverter	Register many functions at once, e.g.
`setOptions($type, $options)`	aConverter	Replace $type's options wholesale.
`setTemplate($name, $tpl)`	TextPrinter	Set template
`setTemplates($tpls)`	TextPrinter
`setVerbosity($verb)`	aModule	Set the current verbosity mask, replacing whatever it was before.
`Shared()`	aModule	Get the shared instance, creating (and configuring) it on first call.
`testVerbosity($level)`	aModule	Test whether a given level (or set of levels) is currently enabled by this instance's verbosity mask.
`traitUnshare($serialize)`	aModule	Remove the shared instance, so the next `Shared()` call creates a fresh one.
`unserialize($data, $path, $instances)`	aModule	\MMO\core\interfaces\iSerializable::unserialize -- merges $data onto `DefaultConfig`, runs it through the (possibly overridden) constructor, then applies each resulting value to its property (via
`Unshare($serialize)`	aModule	Like `tSingleton::Unshare`, but also disconnects this module's instance from every event it was listening to (via `Event::DisconnectListeners`) before dropping it.
`warning($message, $context)`	aModule	Exceptional occurrences that are not errors.
`__construct($config)`	TextPrinter
`__invoke($value, $options, $type)`	TextPrinter	Render $value. Never throws: a failing exporter's exception is caught and printed inline instead (its class and message: `renderPrintError`), and a type with no registered exporter falls back to…