<?php

/**
 * escape_html() — HTML Output Escaping
 *
 * Wraps htmlspecialchars() with the correct encoding and flags.
 * MUST be used on every echoed variable in view files and layouts.
 *
 * Output escaping rule (Sprint 0 Execution Plan, INIT-011):
 *   Every echo in a view must use escape_html(). No raw echo $var ever.
 *
 * Characters escaped:
 *   < > " ' &
 *
 * Usage:
 *   <?= escape_html($title) ?>
 *   <?= escape_html($user['name']) ?>
 *
 * @package Inveetaire
 * @ref     DBP v1.0 Ch.8, TCS, INIT-011 output escaping rule
 */
if (!function_exists('escape_html')) {

    /**
     * Escape a string for safe output inside HTML content or attributes.
     *
     * @param string $value  Raw string to escape.
     * @return string        HTML-safe escaped string.
     */
    function escape_html(string $value): string
    {
        return htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
    }

}
