not->toMatch("/' ' \. \\\$data_query\['name'\]/"); expect(substr_count($source, "htmle(\$data_query['name'])"))->toBe(2); }); test('every tree title component is escaped as it is built', function () use ($reportsPath) { $source = file_get_contents($reportsPath); foreach (['tree_name', 'leaf_name', 'host_name', 'graph_name'] as $part) { expect($source)->not->toMatch('/\$title_delimiter \. " \$' . $part . '"/'); expect($source)->toContain("htmle(\$$part)"); } }); test('the package export form escapes the object name', function () use ($packagePath) { $source = file_get_contents($packagePath); expect($source)->not->toMatch("/value='<\?php print \\\$detail\['name'\]; \?>'/"); expect($source)->toContain("print htmle(\$detail['name'])"); }); test('the escaping helper neutralises both quote styles and script tags', function () { require_once dirname(__DIR__, 4) . '/lib/html.php'; $payload = '\'">'; $escaped = htmle($payload); expect($escaped)->not->toContain('not->toContain('"'); expect($escaped)->not->toContain("'"); });