to break out and * execute. Everything is escaped, then a fixed allowlist of formatting tags is * restored so the existing markup in those messages still renders. */ if (!empty($_SESSION['alert_message'])) { $alert_type = $_SESSION['alert_type'] ?? 'success'; // One mapping for both renderers - see alertStyleClass() in // functions/sanitize.php. flashAlert() is called with more type names than // Bootstrap has classes ('danger', 'alert' and a typo'd 'errpr' among // them), and an unmapped value used to resolve to nothing at all. $alert_style = 'text-bg-' . alertStyleClass($alert_type); // text-bg-info and text-bg-warning are the two Bootstrap pairs with dark text $alert_dark_text = in_array(alertStyleClass($alert_type), ['warning', 'info'], true); // Escaping lives in one place now - see alertMessageHtml() in functions/sanitize.php $alert_safe_message = alertMessageHtml($_SESSION['alert_message']); ?>