Restore merge of phutil_tag.

src/aphront/AphrontRequest.php

@@ -9,7 +9,7 @@
 final class AphrontRequest {
 
   // NOTE: These magic request-type parameters are automatically included in
-  // certain requests (e.g., by phabricator_render_form(), JX.Request,
+  // certain requests (e.g., by phabricator_form(), JX.Request,
   // JX.Workflow, and ConduitClient) and help us figure out what sort of
   // response the client expects.
 

src/aphront/configuration/AphrontDefaultApplicationConfiguration.php

@@ -210,7 +210,7 @@ class AphrontDefaultApplicationConfiguration
 
     if ($ex instanceof AphrontUsageException) {
       $error = new AphrontErrorView();
-      $error->setTitle(phutil_escape_html($ex->getTitle()));
+      $error->setTitle($ex->getTitle());
       $error->appendChild($ex->getMessage());
 
       $view = new PhabricatorStandardPageView();
@@ -227,8 +227,8 @@ class AphrontDefaultApplicationConfiguration
     // Always log the unhandled exception.
     phlog($ex);
 
-    $class    = phutil_escape_html(get_class($ex));
+    $class    = get_class($ex);
-    $message  = phutil_escape_html($ex->getMessage());
+    $message  = $ex->getMessage();
 
     if ($ex instanceof AphrontQuerySchemaException) {
       $message .=
@@ -244,11 +244,13 @@ class AphrontDefaultApplicationConfiguration
       $trace = null;
     }
 
-    $content =
+    $content = hsprintf(
       '<div class="aphront-unhandled-exception">'.
-        '<div class="exception-message">'.$message.'</div>'.
+        '<div class="exception-message">%s</div>'.
-        $trace.
+        '%s'.
-      '</div>';
+      '</div>',
+      $message,
+      $trace);
 
     $dialog = new AphrontDialogView();
     $dialog
@@ -348,17 +350,17 @@ class AphrontDefaultApplicationConfiguration
             ),
             $relative);
         }
-        $file_name = $file_name.' : '.(int)$part['line'];
+        $file_name = hsprintf('%s : %d', $file_name, $part['line']);
       } else {
-        $file_name = '<em>(Internal)</em>';
+        $file_name = phutil_tag('em', array(), '(Internal)');
       }
 
 
       $rows[] = array(
         $depth--,
-        phutil_escape_html($lib),
+        $lib,
         $file_name,
-        phutil_escape_html($where),
+        $where,
       );
     }
     $table = new AphrontTableView($rows);
@@ -377,11 +379,12 @@ class AphrontDefaultApplicationConfiguration
         'wide',
       ));
 
-    return
+    return hsprintf(
       '<div class="exception-trace">'.
         '<div class="exception-trace-header">Stack Trace</div>'.
-        $table->render().
+        '%s',
-      '</div>';
+      '</div>',
+      $table->render());
   }
 
 }

src/aphront/console/plugin/DarkConsoleErrorLogPlugin.php

@@ -36,7 +36,7 @@ final class DarkConsoleErrorLogPlugin extends DarkConsolePlugin {
     $data = $this->getData();
 
     $rows = array();
-    $details = '';
+    $details = array();
 
     foreach ($data as $index => $row) {
       $file = $row['file'];
@@ -50,11 +50,11 @@ final class DarkConsoleErrorLogPlugin extends DarkConsolePlugin {
         $row['str'].' at ['.basename($file).':'.$line.']');
       $rows[] = array($tag);
 
-      $details .=
+      $details[] = hsprintf(
-        '<div class="dark-console-panel-error-details" id="row-details-'.
+        '<div class="dark-console-panel-error-details" id="row-details-%s">'.
-        $index.'">'.
+        "%s\nStack trace:\n",
-        phutil_escape_html($row['details'])."\n".
+        $index,
-        'Stack trace:'."\n";
+        $row['details']);
 
       foreach ($row['trace'] as $key => $entry) {
         $line = '';
@@ -73,16 +73,16 @@ final class DarkConsoleErrorLogPlugin extends DarkConsolePlugin {
           }
         }
 
-        $details .= phutil_tag(
+        $details[] = phutil_tag(
           'a',
           array(
             'href' => $href,
           ),
           $line);
-        $details .= "\n";
+        $details[] = "\n";
       }
 
-      $details .= '</div>';
+      $details[] = hsprintf('</div>');
     }
 
     $table = new AphrontTableView($rows);
@@ -90,11 +90,13 @@ final class DarkConsoleErrorLogPlugin extends DarkConsolePlugin {
     $table->setHeaders(array('Error'));
     $table->setNoDataString('No errors.');
 
-    return '<div>'.
+    return hsprintf(
-      '<div>'.$table->render().'</div>'.
+      '<div>'.
-      '<pre class="PhabricatorMonospaced">'.
+        '<div>%s</div>'.
-      $details.'</pre>'.
+        '<pre class="PhabricatorMonospaced">%s</pre>'.
-      '</div>';
+      '</div>',
+      $table->render(),
+      phutil_implode_html('', $details));
   }
 }
 

src/aphront/console/plugin/DarkConsoleEventPlugin.php

@@ -42,17 +42,14 @@ final class DarkConsoleEventPlugin extends DarkConsolePlugin {
 
     $out = array();
 
-    $out[] =
+    $out[] = hsprintf(
       '<div class="dark-console-panel-header">'.
         '<h1>Registered Event Listeners</h1>'.
-      '</div>';
+      '</div>');
 
     $rows = array();
     foreach ($data['listeners'] as $listener) {
-      $rows[] = array(
+      $rows[] = array($listener['id'], $listener['class']);
-        phutil_escape_html($listener['id']),
-        phutil_escape_html($listener['class']),
-      );
     }
 
     $table = new AphrontTableView($rows);
@@ -69,15 +66,15 @@ final class DarkConsoleEventPlugin extends DarkConsolePlugin {
 
     $out[] = $table->render();
 
-    $out[] =
+    $out[] = hsprintf(
       '<div class="dark-console-panel-header">'.
         '<h1>Event Log</h1>'.
-      '</div>';
+      '</div>');
 
     $rows = array();
     foreach ($data['events'] as $event) {
       $rows[] = array(
-        phutil_escape_html($event['type']),
+        $event['type'],
         $event['stopped'] ? 'STOPPED' : null,
       );
     }
@@ -96,6 +93,6 @@ final class DarkConsoleEventPlugin extends DarkConsolePlugin {
     $out[] = $table->render();
 
 
-    return implode("\n", $out);
+    return phutil_implode_html("\n", $out);
   }
 }

src/aphront/console/plugin/DarkConsoleRequestPlugin.php

@@ -43,8 +43,8 @@ final class DarkConsoleRequestPlugin extends DarkConsolePlugin {
       $rows = array();
       foreach ($map as $key => $value) {
         $rows[] = array(
-          phutil_escape_html($key),
+          $key,
-          phutil_escape_html(is_array($value) ? json_encode($value) : $value),
+          (is_array($value) ? json_encode($value) : $value),
         );
       }
 
@@ -62,6 +62,6 @@ final class DarkConsoleRequestPlugin extends DarkConsolePlugin {
       $out[] = $table->render();
     }
 
-    return implode("\n", $out);
+    return phutil_implode_html("\n", $out);
   }
 }

src/aphront/console/plugin/DarkConsoleServicesPlugin.php

@@ -149,8 +149,12 @@ final class DarkConsoleServicesPlugin extends DarkConsolePlugin {
     $log = $data['log'];
     $results = array();
 
-    $results[] =
+    $results[] = hsprintf(
       '<div class="dark-console-panel-header">'.
+        '%s'.
+        '<h1>Calls to External Services</h1>'.
+        '<div style="clear: both;"></div>'.
+      '</div>',
       phutil_tag(
         'a',
         array(
@@ -159,10 +163,7 @@ final class DarkConsoleServicesPlugin extends DarkConsolePlugin {
             ? 'disabled button'
             : 'green button',
         ),
-          'Analyze Query Plans').
+        'Analyze Query Plans'));
-        '<h1>Calls to External Services</h1>'.
-        '<div style="clear: both;"></div>'.
-      '</div>';
 
     $page_total = $data['end'] - $data['start'];
     $totals = array();
@@ -224,23 +225,18 @@ final class DarkConsoleServicesPlugin extends DarkConsolePlugin {
               $row['explain']['reason']);
           }
 
-          $info = phutil_escape_html($info);
           break;
         case 'connect':
           $info = $row['host'].':'.$row['database'];
-          $info = phutil_escape_html($info);
           break;
         case 'exec':
           $info = $row['command'];
-          $info = phutil_escape_html($info);
           break;
         case 'conduit':
           $info = $row['method'];
-          $info = phutil_escape_html($info);
           break;
         case 'http':
           $info = $row['uri'];
-          $info = phutil_escape_html($info);
           break;
         default:
           $info = '-';
@@ -248,7 +244,7 @@ final class DarkConsoleServicesPlugin extends DarkConsolePlugin {
       }
 
       $rows[] = array(
-        phutil_escape_html($row['type']),
+        $row['type'],
         '+'.number_format(1000 * ($row['begin'] - $data['start'])).' ms',
         number_format(1000000 * $row['duration']).' us',
         $info,
@@ -276,7 +272,7 @@ final class DarkConsoleServicesPlugin extends DarkConsolePlugin {
 
     $results[] = $table->render();
 
-    return implode("\n", $results);
+    return phutil_implode_html("\n", $results);
   }
 }
 

src/aphront/console/plugin/DarkConsoleXHProfPlugin.php

@@ -51,18 +51,22 @@ final class DarkConsoleXHProfPlugin extends DarkConsolePlugin {
           'class' => 'bright-link',
         ),
         'Installation Guide');
-      return
+      return hsprintf(
         '<div class="dark-console-no-content">'.
           'The "xhprof" PHP extension is not available. Install xhprof '.
           'to enable the XHProf console plugin. You can find instructions in '.
-          'the '.$install_guide.'.'.
+          'the %s.'.
-        '</div>';
+        '</div>',
+        $install_guide);
     }
 
     $result = array();
 
-    $header =
+    $header = hsprintf(
       '<div class="dark-console-panel-header">'.
+        '%s'.
+        '<h1>XHProf Profiler</h1>'.
+      '</div>',
       phutil_tag(
         'a',
         array(
@@ -71,28 +75,28 @@ final class DarkConsoleXHProfPlugin extends DarkConsolePlugin {
             ? 'disabled button'
             : 'green button',
         ),
-          'Profile Page').
+        'Profile Page'));
-        '<h1>XHProf Profiler</h1>'.
-      '</div>';
     $result[] = $header;
 
     if ($run) {
-      $result[] =
+      $result[] = hsprintf(
-        '<a href="/xhprof/profile/'.$run.'/" '.
+        '<a href="/xhprof/profile/%s/" '.
           'class="bright-link" '.
           'style="float: right; margin: 1em 2em 0 0;'.
             'font-weight: bold;" '.
           'target="_blank">Profile Permalink</a>'.
-        '<iframe src="/xhprof/profile/'.$run.'/?frame=true"></iframe>';
+        '<iframe src="/xhprof/profile/%s/?frame=true"></iframe>',
+        $run,
+        $run);
     } else {
-      $result[] =
+      $result[] = hsprintf(
         '<div class="dark-console-no-content">'.
           'Profiling was not enabled for this page. Use the button above '.
           'to enable it.'.
-        '</div>';
+        '</div>');
     }
 
-    return implode("\n", $result);
+    return phutil_implode_html("\n", $result);
   }
 
 

src/aphront/response/Aphront403Response.php

@@ -26,7 +26,7 @@ final class Aphront403Response extends AphrontHTMLResponse {
     }
     $failure = new AphrontRequestFailureView();
     $failure->setHeader('403 Forbidden');
-    $failure->appendChild('<p>'.$forbidden_text.'</p>');
+    $failure->appendChild(phutil_tag('p', array(), $forbidden_text));
 
     $view = new PhabricatorStandardPageView();
     $view->setTitle('403 Forbidden');

src/aphront/response/Aphront404Response.php

@@ -12,7 +12,8 @@ final class Aphront404Response extends AphrontHTMLResponse {
   public function buildResponseString() {
     $failure = new AphrontRequestFailureView();
     $failure->setHeader('404 Not Found');
-    $failure->appendChild('<p>The page you requested was not found.</p>');
+    $failure->appendChild(phutil_tag('p', array(), pht(
+      'The page you requested was not found.')));
 
     $view = new PhabricatorStandardPageView();
     $view->setTitle('404 Not Found');

src/aphront/response/AphrontWebpageResponse.php

@@ -13,7 +13,7 @@ final class AphrontWebpageResponse extends AphrontHTMLResponse {
   }
 
   public function buildResponseString() {
-    return $this->content;
+    return hsprintf('%s', $this->content);
   }
 
 }

src/applications/audit/controller/PhabricatorAuditListController.php

@@ -335,7 +335,7 @@ final class PhabricatorAuditListController extends PhabricatorAuditController {
     }
 
     if ($handle) {
-      $handle_name = phutil_escape_html($handle->getName());
+      $handle_name = $handle->getName();
     } else {
       $handle_name = null;
     }
@@ -435,7 +435,7 @@ final class PhabricatorAuditListController extends PhabricatorAuditController {
     }
 
     if ($handle) {
-      $handle_name = phutil_escape_html($handle->getName());
+      $handle_name = $handle->getName();
     } else {
       $handle_name = null;
     }

src/applications/audit/view/PhabricatorAuditCommitListView.php

@@ -70,10 +70,10 @@ final class PhabricatorAuditCommitListView extends AphrontView {
       $rows[] = array(
         $commit_name,
         $author_name,
-        phutil_escape_html($commit->getCommitData()->getSummary()),
+        $commit->getCommitData()->getSummary(),
         PhabricatorAuditCommitStatusConstants::getStatusName(
           $commit->getAuditStatus()),
-        implode(', ', $auditors),
+        phutil_implode_html(', ', $auditors),
         phabricator_datetime($commit->getEpoch(), $this->user),
       );
     }

src/applications/audit/view/PhabricatorAuditListView.php

@@ -129,10 +129,7 @@ final class PhabricatorAuditListView extends AphrontView {
       }
 
       $reasons = $audit->getAuditReasons();
-      foreach ($reasons as $key => $reason) {
+      $reasons = phutil_implode_html(phutil_tag('br'), $reasons);
-        $reasons[$key] = phutil_escape_html($reason);
-      }
-      $reasons = implode('<br />', $reasons);
 
       $status_code = $audit->getAuditStatus();
       $status = PhabricatorAuditStatusConstants::getStatusName($status_code);
@@ -140,10 +137,10 @@ final class PhabricatorAuditListView extends AphrontView {
       $auditor_handle = $this->getHandle($audit->getAuditorPHID());
       $rows[] = array(
         $commit_name,
-        phutil_escape_html($commit_desc),
+        $commit_desc,
         $committed,
         $auditor_handle->renderLink(),
-        phutil_escape_html($status),
+        $status,
         $reasons,
       );
 

src/applications/auth/controller/PhabricatorDisabledUserController.php

@@ -16,8 +16,8 @@ final class PhabricatorDisabledUserController
 
     $failure_view = new AphrontRequestFailureView();
     $failure_view->setHeader(pht('Account Disabled'));
-    $failure_view->appendChild(
+    $failure_view->appendChild(phutil_tag('p', array(), pht(
-      '<p>'.pht('Your account has been disabled.').'</p>');
+      'Your account has been disabled.')));
 
     return $this->buildStandardPageResponse(
       $failure_view,

src/applications/auth/controller/PhabricatorEmailLoginController.php

@@ -98,10 +98,8 @@ EOBODY;
 
           $view = new AphrontRequestFailureView();
           $view->setHeader(pht('Check Your Email'));
-          $view->appendChild(
+          $view->appendChild(phutil_tag('p', array(), pht(
-            '<p>'.pht(
+              'An email has been sent with a link you can use to login.')));
-              'An email has been sent with a link you can use to login.'
-            ).'</p>');
           return $this->buildStandardPageResponse(
             $view,
             array(
@@ -140,8 +138,8 @@ EOBODY;
 
     $panel = new AphrontPanelView();
     $panel->setWidth(AphrontPanelView::WIDTH_FORM);
-    $panel->appendChild('
+    $panel->appendChild(phutil_tag('h1', array(), pht(
-      <h1>'.pht('Forgot Password / Email Login').'</h1>');
+      'Forgot Password / Email Login')));
     $panel->appendChild($email_auth);
     $panel->setNoBackground();
 

src/applications/auth/controller/PhabricatorEmailTokenController.php

@@ -50,17 +50,16 @@ final class PhabricatorEmailTokenController
 
       $view = new AphrontRequestFailureView();
       $view->setHeader(pht('Unable to Login'));
-      $view->appendChild(
+      $view->appendChild(phutil_tag('p', array(), pht(
-        '<p>'.pht('The authentication information in the link you clicked is '.
+        'The authentication information in the link you clicked is '.
         'invalid or out of date. Make sure you are copy-and-pasting the '.
         'entire link into your browser. You can try again, or request '.
-        'a new email.').'</p>');
+        'a new email.')));
-      $view->appendChild(
+      $view->appendChild(hsprintf(
         '<div class="aphront-failure-continue">'.
-          '<a class="button" href="/login/email/">'.
+          '<a class="button" href="/login/email/">%s</a>'.
-            pht('Send Another Email').
+        '</div>',
-          '</a>'.
+        pht('Send Another Email')));
-        '</div>');
 
       return $this->buildStandardPageResponse(
         $view,

src/applications/auth/controller/PhabricatorLDAPLoginController.php

@@ -43,12 +43,11 @@ final class PhabricatorLDAPLoginController extends PhabricatorAuthController {
               $dialog = new AphrontDialogView();
               $dialog->setUser($current_user);
               $dialog->setTitle(pht('Already Linked to Another Account'));
-              $dialog->appendChild(
+              $dialog->appendChild(phutil_tag('p', array(), pht(
-                '<p>'.pht('The LDAP account you just authorized is already '.
+                'The LDAP account you just authorized is already '.
                 'linked toanother Phabricator account. Before you can link it '.
                 'to a different LDAP account, you must unlink the old '.
-                'account.').'</p>'
+                'account.')));
-              );
               $dialog->addCancelButton('/settings/panel/ldap/');
 
               return id(new AphrontDialogResponse())->setDialog($dialog);
@@ -62,10 +61,8 @@ final class PhabricatorLDAPLoginController extends PhabricatorAuthController {
             $dialog = new AphrontDialogView();
             $dialog->setUser($current_user);
             $dialog->setTitle(pht('Link LDAP Account'));
-            $dialog->appendChild(
+            $dialog->appendChild(phutil_tag('p', array(), pht(
-              '<p>'.
+              'Link your LDAP account to your Phabricator account?')));
-                pht('Link your LDAP account to your Phabricator account?').
-              '</p>');
             $dialog->addHiddenInput('username', $request->getStr('username'));
             $dialog->addHiddenInput('password', $request->getStr('password'));
             $dialog->addSubmitButton(pht('Link Accounts'));
@@ -134,9 +131,10 @@ final class PhabricatorLDAPLoginController extends PhabricatorAuthController {
 
     $panel = new AphrontPanelView();
     $panel->setWidth(AphrontPanelView::WIDTH_FORM);
-    $panel->appendChild('<h1>'.pht('LDAP login').'</h1>');
+    $panel->appendChild(phutil_tag('h1', array(), pht('LDAP login')));
     $panel->appendChild($ldap_form);
 
+    $error_view = null;
     if (isset($errors) && count($errors) > 0) {
       $error_view = new AphrontErrorView();
       $error_view->setTitle(pht('Login Failed'));
@@ -145,7 +143,7 @@ final class PhabricatorLDAPLoginController extends PhabricatorAuthController {
 
     return $this->buildStandardPageResponse(
       array(
-        isset($error_view) ? $error_view : null,
+        $error_view,
         $panel,
       ),
       array(

src/applications/auth/controller/PhabricatorLDAPUnlinkController.php

@@ -18,9 +18,9 @@ final class PhabricatorLDAPUnlinkController extends PhabricatorAuthController {
       $dialog = new AphrontDialogView();
       $dialog->setUser($user);
       $dialog->setTitle(pht('Really unlink account?'));
-      $dialog->appendChild(
+      $dialog->appendChild(phutil_tag('p', array(), pht(
-        '<p>'.pht('You will not be able to login using this account '.
+        'You will not be able to login using this account '.
-        'once you unlink it. Continue?').'</p>');
+        'once you unlink it. Continue?')));
       $dialog->addSubmitButton(pht('Unlink Account'));
       $dialog->addCancelButton('/settings/panel/ldap/');
 

src/applications/auth/controller/PhabricatorLoginController.php

@@ -29,7 +29,8 @@ final class PhabricatorLoginController
       $dialog = new AphrontDialogView();
       $dialog->setUser($user);
       $dialog->setTitle(pht('Login Required'));
-      $dialog->appendChild('<p>'.pht('You must login to continue.').'</p>');
+      $dialog->appendChild(phutil_tag('p', array(), pht(
+        'You must login to continue.')));
       $dialog->addSubmitButton(pht('Login'));
       $dialog->addCancelButton('/', pht('Cancel'));
 
@@ -246,8 +247,7 @@ final class PhabricatorLoginController
         $title = pht("Login or Register with %s", $provider_name);
         $body = pht('Login or register for Phabricator using your %s account.',
           $provider_name);
-        $button = pht("Login or Register with %s",
+        $button = pht("Login or Register with %s", $provider_name);
-          phutil_escape_html($provider_name));
       } else {
         $title = pht("Login with %s", $provider_name);
         $body = hsprintf(
@@ -258,7 +258,7 @@ final class PhabricatorLoginController
           pht(
             'You can not use %s to register a new account.',
             $provider_name));
-        $button = pht("Log in with %s", phutil_escape_html($provider_name));
+        $button = pht("Log in with %s", $provider_name);
       }
 
       $auth_form = new AphrontFormView();
@@ -299,7 +299,7 @@ final class PhabricatorLoginController
     return $this->buildApplicationPage(
       array(
         $error_view,
-        $login_message,
+        phutil_safe_html($login_message),
         $panel,
       ),
       array(

src/applications/auth/controller/PhabricatorLoginValidateController.php

@@ -49,14 +49,18 @@ final class PhabricatorLoginValidateController
 
       $view = new AphrontRequestFailureView();
       $view->setHeader(pht('Login Failed'));
-      $view->appendChild(
+      $view->appendChild(hsprintf(
-        '<p>'.pht('Login failed:').'</p>'.
+        '<p>%s</p>%s<p>%s</p>',
-        $list.
+        pht('Login failed:'),
-        '<p>'.pht('<strong>Clear your cookies</strong> and try again.').'</p>');
+        $list,
-      $view->appendChild(
+        pht(
+          '<strong>Clear your cookies</strong> and try again.',
+          hsprintf(''))));
+      $view->appendChild(hsprintf(
         '<div class="aphront-failure-continue">'.
-          '<a class="button" href="/login/">'.pht('Try Again').'</a>'.
+          '<a class="button" href="/login/">%s</a>'.
-        '</div>');
+        '</div>',
+        pht('Try Again')));
       return $this->buildStandardPageResponse(
         $view,
         array(

src/applications/auth/controller/PhabricatorLogoutController.php

@@ -46,7 +46,8 @@ final class PhabricatorLogoutController
       $dialog = id(new AphrontDialogView())
         ->setUser($user)
         ->setTitle(pht('Log out of Phabricator?'))
-        ->appendChild('<p>'.pht('Are you sure you want to log out?').'</p>')
+        ->appendChild(phutil_tag('p', array(), pht(
+          'Are you sure you want to log out?')))
         ->addSubmitButton(pht('Logout'))
         ->addCancelButton('/');
 

src/applications/auth/controller/PhabricatorMustVerifyEmailController.php

@@ -41,19 +41,15 @@ final class PhabricatorMustVerifyEmailController
 
     $error_view = new AphrontRequestFailureView();
     $error_view->setHeader(pht('Check Your Email'));
-    $error_view->appendChild(
+    $error_view->appendChild(phutil_tag('p', array(), pht(
-      '<p>'.
+      'You must verify your email address to login. You should have a new '.
-      pht('You must verify your email address to login. You should have a new '.
       'email message from Phabricator with verification instructions in your '.
-      'inbox (%s).', phutil_tag('strong', array(), $email_address)).
+      'inbox (%s).', phutil_tag('strong', array(), $email_address))));
-      '</p>');
+    $error_view->appendChild(phutil_tag('p', array(), pht(
-    $error_view->appendChild(
+      'If you did not receive an email, you can click the button below '.
-      '<p>'.
+      'to try sending another one.')));
-      pht('If you did not receive an email, you can click the button below '.
+    $error_view->appendChild(hsprintf(
-      'to try sending another one.').
+      '<div class="aphront-failure-continue">%s</div>',
-      '</p>');
-    $error_view->appendChild(
-      '<div class="aphront-failure-continue">'.
       phabricator_form(
         $user,
         array(
@@ -64,8 +60,7 @@ final class PhabricatorMustVerifyEmailController
           'button',
           array(
           ),
-            pht('Send Another Email'))).
+          pht('Send Another Email')))));
-      '</div>');
 
 
     return $this->buildApplicationPage(

src/applications/auth/controller/PhabricatorOAuthDiagnosticsController.php

@@ -21,11 +21,11 @@ final class PhabricatorOAuthDiagnosticsController
     $client_id      = $provider->getClientID();
     $client_secret  = $provider->getClientSecret();
     $key            = $provider->getProviderKey();
-    $name           = phutil_escape_html($provider->getProviderName());
+    $name           = $provider->getProviderName();
 
-    $res_ok = '<strong style="color: #00aa00;">OK</strong>';
+    $res_ok = hsprintf('<strong style="color: #00aa00;">OK</strong>');
-    $res_no = '<strong style="color: #aa0000;">NO</strong>';
+    $res_no = hsprintf('<strong style="color: #aa0000;">NO</strong>');
-    $res_na = '<strong style="color: #999999;">N/A</strong>';
+    $res_na = hsprintf('<strong style="color: #999999;">N/A</strong>');
 
     $results = array();
     $auth_key = $key . '.auth-enabled';
@@ -159,10 +159,10 @@ final class PhabricatorOAuthDiagnosticsController
     $rows = array();
     foreach ($results as $key => $result) {
       $rows[] = array(
-        phutil_escape_html($key),
+        $key,
         $result[0],
-        phutil_escape_html($result[1]),
+        $result[1],
-        phutil_escape_html($result[2]),
+        $result[2],
       );
     }
 
@@ -186,11 +186,11 @@ final class PhabricatorOAuthDiagnosticsController
 
     $panel_view = new AphrontPanelView();
     $panel_view->setHeader($title);
-    $panel_view->appendChild(
+    $panel_view->appendChild(hsprintf(
       '<p class="aphront-panel-instructions">These tests may be able to '.
-      'help diagnose the root cause of problems you experience with '.
+      'help diagnose the root cause of problems you experience with %s '.
-      $provider->getProviderName() .
+      'Authentication. Reload the page to run the tests again.</p>',
-      ' Authentication. Reload the page to run the tests again.</p>');
+      $provider->getProviderName()));
     $panel_view->appendChild($table_view);
 
     return $this->buildStandardPageResponse(

src/applications/auth/controller/PhabricatorOAuthLoginController.php

@@ -116,10 +116,9 @@ final class PhabricatorOAuthLoginController
         $dialog = new AphrontDialogView();
         $dialog->setUser($current_user);
         $dialog->setTitle(pht('Link %s Account', $provider_name));
-        $dialog->appendChild(
+        $dialog->appendChild(phutil_tag('p', array(), pht(
-          pht(
+          'Link your %s account to your Phabricator account?',
-            '<p>Link your %s account to your Phabricator account?</p>',
+          $provider_name)));
-            phutil_escape_html($provider_name)));
         $dialog->addHiddenInput('confirm_token', $provider->getAccessToken());
         $dialog->addHiddenInput('expires', $oauth_info->getTokenExpires());
         $dialog->addHiddenInput('state', $this->oauthState);

src/applications/auth/controller/PhabricatorOAuthUnlinkController.php

@@ -34,9 +34,9 @@ final class PhabricatorOAuthUnlinkController extends PhabricatorAuthController {
       $dialog = new AphrontDialogView();
       $dialog->setUser($user);
       $dialog->setTitle(pht('Really unlink account?'));
-      $dialog->appendChild(
+      $dialog->appendChild(phutil_tag('p', array(), pht(
-        '<p>'.pht('You will not be able to login using this account '.
+        'You will not be able to login using this account '.
-        'once you unlink it. Continue?').'</p>');
+        'once you unlink it. Continue?')));
       $dialog->addSubmitButton(pht('Unlink Account'));
       $dialog->addCancelButton($provider->getSettingsPanelURI());
 

src/applications/auth/view/PhabricatorOAuthFailureView.php

@@ -77,11 +77,12 @@ final class PhabricatorOAuthFailureView extends AphrontView {
         $provider_name);
     }
 
-    $view->appendChild(
+    $view->appendChild(hsprintf(
       '<div class="aphront-failure-continue">'.
-        $diagnose.
+        '%s<a href="/login/" class="button">%s</a>'.
-        '<a href="/login/" class="button">'.pht('Continue').'</a>'.
+      '</div>',
-      '</div>');
+      $diagnose,
+      pht('Continue')));
 
     return $view->render();
   }

src/applications/base/controller/PhabricatorController.php

@@ -203,10 +203,9 @@ abstract class PhabricatorController extends AphrontController {
         $view = new PhabricatorStandardPageView();
         $view->setRequest($request);
         $view->setController($this);
-        $view->appendChild(
+        $view->appendChild(hsprintf(
-          '<div style="padding: 2em 0;">'.
+          '<div style="padding: 2em 0;">%s</div>',
-            $response->buildResponseString().
+          $response->buildResponseString()));
-          '</div>');
         $response = new AphrontWebpageResponse();
         $response->setContent($view->render());
         return $response;
@@ -277,7 +276,7 @@ abstract class PhabricatorController extends AphrontController {
       $items[] = $this->getHandle($phid)->renderLink();
     }
 
-    return array_interleave($style_map[$style], $items);
+    return phutil_implode_html($style_map[$style], $items);
   }
 
   protected function buildApplicationMenu() {

src/applications/calendar/controller/PhabricatorCalendarBrowseController.php

@@ -55,9 +55,7 @@ final class PhabricatorCalendarBrowseController
     $nav->appendChild(
       array(
         $this->getNoticeView(),
-        '<div style="padding: 20px;">',
+        hsprintf('<div style="padding: 20px;">%s</div>', $month_view->render()),
-          $month_view,
-        '</div>',
       ));
 
     return $this->buildApplicationPage(

src/applications/calendar/controller/PhabricatorCalendarViewStatusController.php

@@ -94,7 +94,7 @@ final class PhabricatorCalendarViewStatusController
     } else {
       $no_data =
         pht('%s does not have any upcoming status events.',
-            phutil_escape_html($this->getHandle($this->phid)->getName()));
+            $this->getHandle($this->phid)->getName());
     }
     return $no_data;
   }
@@ -115,7 +115,7 @@ final class PhabricatorCalendarViewStatusController
     } else {
       $page_title = pht(
         'Upcoming Statuses for %s',
-        phutil_escape_html($this->getHandle($this->phid)->getName())
+        $this->getHandle($this->phid)->getName()
       );
     }
     return $page_title;

src/applications/calendar/view/AphrontCalendarMonthView.php

@@ -48,9 +48,10 @@ final class AphrontCalendarMonthView extends AphrontView {
 
     $markup = array();
 
-    $empty_box =
+    $empty_box = phutil_tag(
-      '<div class="aphront-calendar-day aphront-calendar-empty">'.
+      'div',
-      '</div>';
+      array('class' => 'aphront-calendar-day aphront-calendar-empty'),
+      '');
 
     for ($ii = 0; $ii < $empty; $ii++) {
       $markup[] = $empty_box;
@@ -79,9 +80,10 @@ final class AphrontCalendarMonthView extends AphrontView {
       } else {
         $show_events = array_fill_keys(
           array_keys($show_events),
+          hsprintf(
             '<div class="aphront-calendar-event aphront-calendar-event-empty">'.
               '&nbsp;'.
-          '</div>');
+            '</div>'));
       }
 
       foreach ($events as $event) {
@@ -100,38 +102,42 @@ final class AphrontCalendarMonthView extends AphrontView {
 
       $holiday_markup = null;
       if ($holiday) {
-        $name = phutil_escape_html($holiday->getName());
+        $name = $holiday->getName();
-        $holiday_markup =
+        $holiday_markup = phutil_tag(
-          '<div class="aphront-calendar-holiday" title="'.$name.'">'.
+          'div',
-            $name.
+          array(
-          '</div>';
+            'class' => 'aphront-calendar-holiday',
+            'title' => $name,
+          ),
+          $name);
       }
 
-      $markup[] =
+      $markup[] = hsprintf(
-        '<div class="'.$class.'">'.
+        '<div class="%s">'.
-          '<div class="aphront-calendar-date-number">'.
+          '<div class="aphront-calendar-date-number">%s</div>'.
-            $day_number.
+          '%s%s'.
-          '</div>'.
+        '</div>',
-          $holiday_markup.
+        $class,
-          implode("\n", $show_events).
+        $day_number,
-        '</div>';
+        $holiday_markup,
+        phutil_implode_html("\n", $show_events));
     }
 
     $table = array();
     $rows = array_chunk($markup, 7);
     foreach ($rows as $row) {
-      $table[] = '<tr>';
+      $table[] = hsprintf('<tr>');
       while (count($row) < 7) {
         $row[] = $empty_box;
       }
       foreach ($row as $cell) {
-        $table[] = '<td>'.$cell.'</td>';
+        $table[] = phutil_tag('p', array(), $cell);
       }
-      $table[] = '</tr>';
+      $table[] = hsprintf('</tr>');
     }
-    $table =
+    $table = hsprintf(
       '<table class="aphront-calendar-view">'.
-        $this->renderCalendarHeader($first).
+       '%s'.
        '<tr class="aphront-calendar-day-of-week-header">'.
           '<th>Sun</th>'.
           '<th>Mon</th>'.
@@ -141,8 +147,10 @@ final class AphrontCalendarMonthView extends AphrontView {
           '<th>Fri</th>'.
           '<th>Sat</th>'.
         '</tr>'.
-        implode("\n", $table).
+        '%s'.
-      '</table>';
+      '</table>',
+      $this->renderCalendarHeader($first),
+      phutil_implode_html("\n", $table));
 
     return $table;
   }
@@ -173,16 +181,15 @@ final class AphrontCalendarMonthView extends AphrontView {
         "\xE2\x86\x92"
       );
 
-      $left_th = '<th>'.$prev_link.'</th>';
+      $left_th = phutil_tag('th', array(), $prev_link);
-      $right_th = '<th>'.$next_link.'</th>';
+      $right_th = phutil_tag('th', array(), $next_link);
     }
 
-    return
+    return hsprintf(
-      '<tr class="aphront-calendar-month-year-header">'.
+      '<tr class="aphront-calendar-month-year-header">%s%s%s</tr>',
-        $left_th.
+      $left_th,
-        '<th colspan="'.$colspan.'">'.$date->format('F Y').'</th>'.
+      phutil_tag('th', array('colspan' => $colspan), $date->format('F Y')),
-        $right_th.
+      $right_th);
-      '</tr>';
   }
 
   private function getNextYearAndMonth() {

src/applications/chatlog/controller/PhabricatorChatLogChannelLogController.php

@@ -94,7 +94,6 @@ final class PhabricatorChatLogChannelLogController
     require_celerity_resource('phabricator-chatlog-css');
 
     $out = array();
-    $out[] = '<table class="phabricator-chat-log">';
     foreach ($blocks as $block) {
       $author = $block['author'];
       $author = phutil_utf8_shorten($author, 18);
@@ -122,7 +121,6 @@ final class PhabricatorChatLogChannelLogController
         ),
         array($author, $message, $timestamp));
     }
-    $out[] = '</table>';
 
     $form = id(new AphrontFormView())
       ->setUser($user)
@@ -140,12 +138,11 @@ final class PhabricatorChatLogChannelLogController
 
     return $this->buildStandardPageResponse(
       array(
-        '<div class="phabricator-chat-log-panel">',
+        hsprintf(
+          '<div class="phabricator-chat-log-panel">%s<br />%s%s</div>',
           $form,
-        '<br />',
+          phutil_tag('table', array('class' => 'phabricator-chat-log'), $out),
-        implode("\n", $out),
+          $pager),
-        $pager,
-        '</div>',
       ),
       array(
         'title' => 'Channel Log',

src/applications/conduit/controller/PhabricatorConduitAPIController.php

@@ -346,7 +346,7 @@ final class PhabricatorConduitAPIController
     if ($request) {
       foreach ($request->getAllParameters() as $key => $value) {
         $param_rows[] = array(
-          phutil_escape_html($key),
+          $key,
           $this->renderAPIValue($value),
         );
       }
@@ -362,7 +362,7 @@ final class PhabricatorConduitAPIController
     $result_rows = array();
     foreach ($result as $key => $value) {
       $result_rows[] = array(
-        phutil_escape_html($key),
+        $key,
         $this->renderAPIValue($value),
       );
     }

src/applications/conduit/controller/PhabricatorConduitConsoleController.php

@@ -109,7 +109,7 @@ final class PhabricatorConduitConsoleController
           ->setValue('Call Method'));
 
     $panel = new AphrontPanelView();
-    $panel->setHeader('Conduit API: '.phutil_escape_html($this->method));
+    $panel->setHeader('Conduit API: '.$this->method);
     $panel->appendChild($form);
     $panel->setWidth(AphrontPanelView::WIDTH_FULL);
 

src/applications/conduit/controller/PhabricatorConduitListController.php

@@ -59,11 +59,11 @@ final class PhabricatorConduitListController
 
     $utils = new AphrontPanelView();
     $utils->setHeader('Utilities');
-    $utils->appendChild(
+    $utils->appendChild(hsprintf(
       '<ul>'.
       '<li><a href="/conduit/log/">Log</a> - Conduit Method Calls</li>'.
       '<li><a href="/conduit/token/">Token</a> - Certificate Install</li>'.
-      '</ul>');
+      '</ul>'));
     $utils->setWidth(AphrontPanelView::WIDTH_FULL);
 
     $this->setShowSideNav(false);

src/applications/conduit/controller/PhabricatorConduitLogController.php

@@ -65,9 +65,9 @@ final class PhabricatorConduitLogController
       }
       $rows[] = array(
         $call->getConnectionID(),
-        phutil_escape_html($conn->getUserName()),
+        $conn->getUserName(),
-        phutil_escape_html($call->getMethod()),
+        $call->getMethod(),
-        phutil_escape_html($call->getError()),
+        $call->getError(),
         number_format($call->getDuration()).' us',
         phabricator_datetime($call->getDateCreated(), $user),
       );

src/applications/config/controller/PhabricatorConfigAllController.php

@@ -14,13 +14,12 @@ final class PhabricatorConfigAllController
       $key = $option->getKey();
 
       if ($option->getMasked()) {
-        $value = '<em>'.pht('Masked').'</em>';
+        $value = phutil_tag('em', array(), pht('Masked'));
       } else if ($option->getHidden()) {
-        $value = '<em>'.pht('Hidden').'</em>';
+        $value = phutil_tag('em', array(), pht('Hidden'));
       } else {
         $value = PhabricatorEnv::getEnvConfig($key);
         $value = PhabricatorConfigJSON::prettyPrintJSON($value);
-        $value = phutil_escape_html($value);
       }
 
       $rows[] = array(

src/applications/config/response/PhabricatorConfigResponse.php

@@ -23,20 +23,18 @@ final class PhabricatorConfigResponse extends AphrontHTMLResponse {
 
     $view = $this->view->render();
 
-    $template = <<<EOTEMPLATE
+    return hsprintf(
-<!doctype html>
+      '<!DOCTYPE html>'.
-<html>
+      '<html>'.
-  <head>
+        '<head>'.
-    <title>Phabricator Setup</title>
+          '<meta charset="UTF-8" />'.
-    {$resources}
+          '<title>Phabricator Setup</title>'.
-  </head>
+          '%s'.
-  <body class="setup-fatal">
+        '</head>'.
-    {$view}
+        '<body class="setup-fatal">%s</body>'.
-  </body>
+      '</html>',
-</html>
+      $resources,
-EOTEMPLATE;
+      $view);
-
-    return $template;
   }
 
   private function buildResources() {
@@ -49,11 +47,12 @@ EOTEMPLATE;
 
     $resources = array();
     foreach ($css as $path) {
-      $resources[] = '<style type="text/css">';
+      $resources[] = phutil_tag(
-      $resources[] = Filesystem::readFile($webroot.'/rsrc/css/'.$path);
+        'style',
-      $resources[] = '</style>';
+        array('type' => 'text/css'),
+        Filesystem::readFile($webroot.'/rsrc/css/'.$path));
     }
-    return implode("\n", $resources);
+    return phutil_implode_html("\n", $resources);
   }
 
 

src/applications/config/view/PhabricatorSetupIssueView.php

@@ -44,7 +44,7 @@ final class PhabricatorSetupIssueView extends AphrontView {
         ),
         array(
           phutil_tag('p', array(), $run_these),
-          phutil_tag('pre', array(), array_interleave("\n", $commands)),
+          phutil_tag('pre', array(), phutil_implode_html("\n", $commands)),
         ));
     }
 
@@ -114,7 +114,7 @@ final class PhabricatorSetupIssueView extends AphrontView {
       array(
         'class' => 'setup-issue',
       ),
-      $this->renderHTMLView(
+      $this->renderSingleView(
         array(
           $name,
           $description,
@@ -155,7 +155,7 @@ final class PhabricatorSetupIssueView extends AphrontView {
           '<tt>phabricator/ $</tt> ./bin/config set %s <em>value</em>',
           $key);
       }
-      $update = phutil_tag('pre', array(), array_interleave("\n", $update));
+      $update = phutil_tag('pre', array(), phutil_implode_html("\n", $update));
     } else {
       $update = array();
       foreach ($configs as $config) {
@@ -187,7 +187,7 @@ final class PhabricatorSetupIssueView extends AphrontView {
       array(
         'class' => 'setup-issue-config',
       ),
-      self::renderHTMLView(
+      self::renderSingleView(
         array(
           $table_info,
           $table,
@@ -293,7 +293,7 @@ final class PhabricatorSetupIssueView extends AphrontView {
       array(
         'class' => 'setup-issue-config',
       ),
-      $this->renderHTMLView(
+      $this->renderSingleView(
         array(
           $table_info,
           $table,

src/applications/conpherence/controller/ConpherenceController.php

@@ -159,8 +159,7 @@ abstract class ConpherenceController extends PhabricatorController {
         $item->addClass('hide-unread-count');
       }
 
-      // TODO: [HTML] Clean this up when we clean up HTML stuff in Conpherence.
+      $nav->addCustomBlock($item->render());
-      $nav->addCustomBlock(phutil_safe_html($item->render()));
     }
     if (empty($conpherences) || $read) {
       $nav->addCustomBlock($this->getNoConpherencesBlock());

src/applications/conpherence/controller/ConpherenceViewController.php

@@ -149,7 +149,7 @@ final class ConpherenceViewController extends
         ->setMarkupEngine($engine)
         ->render();
     }
-    $transactions = implode(' ', $rendered_transactions);
+    $transactions = phutil_implode_html(' ', $rendered_transactions);
 
     $form =
       id(new AphrontFormView())
@@ -283,7 +283,7 @@ final class ConpherenceViewController extends
             'src' => $thumb
           ),
           ''),
-        phutil_escape_html($file->getName()),
+        $file->getName(),
       );
     }
     $header = id(new PhabricatorHeaderView())
@@ -292,7 +292,7 @@ final class ConpherenceViewController extends
         ->setNoDataString(pht('No files attached to conpherence.'))
         ->setHeaders(array('', pht('Name')))
         ->setColumnClasses(array('', 'wide'));
-    return new PhutilSafeHTML($header->render() . $table->render());
+    return hsprintf('%s%s', $header->render(), $table->render());
   }
 
   private function renderTaskWidgetPaneContent() {
@@ -328,7 +328,7 @@ final class ConpherenceViewController extends
         ->setColumnClasses(array('', 'wide'));
       $content[] = $table->render();
     }
-    return new PhutilSafeHTML(implode('', $content));
+    return phutil_implode_html('', $content);
   }
 
   private function renderCalendarWidgetPaneContent() {
@@ -416,7 +416,7 @@ final class ConpherenceViewController extends
       }
     }
 
-    return new PhutilSafeHTML(implode('', $content));
+    return phutil_implode_html('', $content);
   }
 
   private function getCalendarWidgetWeekTimestamps() {

src/applications/conpherence/storage/ConpherenceTransaction.php

@@ -50,18 +50,18 @@ final class ConpherenceTransaction extends PhabricatorApplicationTransaction {
           $title = pht(
             '%s renamed this conpherence from "%s" to "%s".',
             $this->renderHandleLink($author_phid),
-            phutil_escape_html($old),
+            $old,
-            phutil_escape_html($new));
+            $new);
         } else if ($old) {
           $title = pht(
             '%s deleted the conpherence name "%s".',
             $this->renderHandleLink($author_phid),
-            phutil_escape_html($old));
+            $old);
         } else {
           $title = pht(
             '%s named this conpherence "%s".',
             $this->renderHandleLink($author_phid),
-            phutil_escape_html($new));
+            $new);
         }
         return $title;
       case ConpherenceTransactionType::TYPE_FILES:

src/applications/conpherence/view/ConpherenceMenuItemView.php

@@ -139,7 +139,7 @@ final class ConpherenceMenuItemView extends AphrontTagView {
         (int)$this->unreadCount);
     }
 
-    return $this->renderHTMLView(
+    return $this->renderSingleView(
       array(
         $image,
         $title,

src/applications/conpherence/view/ConpherenceTransactionView.php

@@ -87,7 +87,7 @@ final class ConpherenceTransactionView extends AphrontView {
         array(
           'class' => $content_class
         ),
-        $this->renderHTMLView($content))
+        $this->renderSingleView($content))
       );
 
     return $transaction_view->render();

src/applications/countdown/controller/PhabricatorCountdownListController.php

@@ -46,7 +46,7 @@ final class PhabricatorCountdownListController
           'Delete');
       }
       $rows[] = array(
-        phutil_escape_html($timer->getID()),
+        $timer->getID(),
         $handles[$timer->getAuthorPHID()]->renderLink(),
         phutil_tag(
           'a',

src/applications/daemon/controller/PhabricatorDaemonConsoleController.php

@@ -30,7 +30,7 @@ final class PhabricatorDaemonConsoleController
     $rows = array();
     foreach ($completed_info as $class => $info) {
       $rows[] = array(
-        phutil_escape_html($class),
+        $class,
         number_format($info['n']),
         number_format((int)($info['duration'] / $info['n'])).' us',
       );
@@ -127,7 +127,7 @@ final class PhabricatorDaemonConsoleController
     $rows = array();
     foreach ($queued as $row) {
       $rows[] = array(
-        phutil_escape_html($row['taskClass']),
+        $row['taskClass'],
         number_format($row['N']),
       );
     }

src/applications/daemon/controller/PhabricatorWorkerTaskUpdateController.php

@@ -72,41 +72,40 @@ final class PhabricatorWorkerTaskUpdateController
       case 'retry':
         if ($can_retry) {
           $dialog->setTitle('Really retry task?');
-          $dialog->appendChild(
+          $dialog->appendChild(phutil_tag('p', array(), pht(
-            '<p>The task will be put back in the queue and executed '.
+            'The task will be put back in the queue and executed again.')));
-            'again.</p>');
           $dialog->addSubmitButton('Retry Task');
         } else {
           $dialog->setTitle('Can Not Retry');
-          $dialog->appendChild(
+          $dialog->appendChild(phutil_tag('p', array(), pht(
-            '<p>Only archived, unsuccessful tasks can be retried.</p>');
+            'Only archived, unsuccessful tasks can be retried.')));
         }
         break;
       case 'cancel':
         if ($can_cancel) {
           $dialog->setTitle('Really cancel task?');
-          $dialog->appendChild(
+          $dialog->appendChild(phutil_tag('p', array(), pht(
-            '<p>The work this task represents will never be performed if you '.
+            'The work this task represents will never be performed if you '.
-            'cancel it. Are you sure you want to cancel it?</p>');
+            'cancel it. Are you sure you want to cancel it?')));
           $dialog->addSubmitButton('Cancel Task');
         } else {
           $dialog->setTitle('Can Not Cancel');
-          $dialog->appendChild(
+          $dialog->appendChild(phutil_tag('p', array(), pht(
-            '<p>Only active tasks can be cancelled.</p>');
+            'Only active tasks can be cancelled.')));
         }
         break;
       case 'release':
         if ($can_release) {
           $dialog->setTitle('Really free task lease?');
-          $dialog->appendChild(
+          $dialog->appendChild(phutil_tag('p', array(), pht(
-            '<p>If the process which owns the task lease is still doing work '.
+            'If the process which owns the task lease is still doing work '.
             'on it, the work may be performed twice. Are you sure you '.
-            'want to free the lease?</p>');
+            'want to free the lease?')));
           $dialog->addSubmitButton('Free Lease');
         } else {
           $dialog->setTitle('Can Not Free Lease');
-          $dialog->appendChild(
+          $dialog->appendChild(phutil_tag('p', array(), pht(
-            '<p>Only active, leased tasks may have their leases freed.</p>');
+            'Only active, leased tasks may have their leases freed.')));
         }
         break;
       default:

src/applications/daemon/view/PhabricatorDaemonLogEventsView.php

@@ -60,7 +60,7 @@ final class PhabricatorDaemonLogEventsView extends AphrontView {
       }
 
       $row = array(
-        phutil_escape_html($event->getLogType()),
+        $event->getLogType(),
         phabricator_date($event->getEpoch(), $this->user),
         phabricator_time($event->getEpoch(), $this->user),
         phutil_escape_html_newlines($message.$more),

src/applications/daemon/view/PhabricatorDaemonLogListView.php

@@ -76,8 +76,8 @@ final class PhabricatorDaemonLogListView extends AphrontView {
 
       $rows[] = array(
         $running,
-        phutil_escape_html($log->getDaemon()),
+        $log->getDaemon(),
-        phutil_escape_html($log->getHost()),
+        $log->getHost(),
         $log->getPID(),
         phabricator_date($epoch, $this->user),
         phabricator_time($epoch, $this->user),

src/applications/differential/controller/DifferentialCommentSaveController.php

@@ -60,10 +60,9 @@ final class DifferentialCommentSaveController extends DifferentialController {
 
       if (strlen($comment) || $has_inlines) {
         $dialog->addSubmitButton(pht('Post as Comment'));
-        $dialog->appendChild('<br />');
+        $dialog->appendChild(phutil_tag('br'));
-        $dialog->appendChild(
+        $dialog->appendChild(phutil_tag('p', array(), pht(
-          '<p>'.pht('Do you want to post your feedback anyway, as a normal '.
+          'Do you want to post your feedback anyway, as a normal comment?')));
-          'comment?').'</p>');
       }
 
       return id(new AphrontDialogResponse())->setDialog($dialog);

src/applications/differential/controller/DifferentialDiffViewController.php

@@ -25,16 +25,21 @@ final class DifferentialDiffViewController extends DifferentialController {
           'href' => PhabricatorEnv::getURI('/D'.$diff->getRevisionID()),
         ),
         'D'.$diff->getRevisionID());
-      $top_panel->appendChild(
+      $top_panel->appendChild(phutil_tag(
-        "<h1>".pht('This diff belongs to revision %s', $link)."</h1>");
+        'h1',
+        array(),
+        pht('This diff belongs to revision %s', $link)));
     } else {
       $action_panel = new AphrontPanelView();
       $action_panel->setHeader('Preview Diff');
       $action_panel->setWidth(AphrontPanelView::WIDTH_WIDE);
-      $action_panel->appendChild(
+      $action_panel->appendChild(hsprintf(
-        '<p class="aphront-panel-instructions">'.pht('Review the diff for '.
+        '<p class="aphront-panel-instructions">%s</p>',
-        'correctness. When you are satisfied, either <strong>create a new '.
+        pht(
-        'revision</strong> or <strong>update an existing revision</strong>.'));
+          'Review the diff for correctness. When you are satisfied, either '.
+          '<strong>create a new revision</strong> or <strong>update '.
+          'an existing revision</strong>.',
+          hsprintf(''))));
 
       // TODO: implmenent optgroup support in AphrontFormSelectControl?
       $select = array();

src/applications/differential/controller/DifferentialRevisionViewController.php

@@ -386,14 +386,15 @@ final class DifferentialRevisionViewController extends DifferentialController {
 
     $page_pane = id(new DifferentialPrimaryPaneView())
       ->setID($pane_id)
-      ->appendChild(
+      ->appendChild(array(
-        $comment_view->render().
+        $comment_view->render(),
-        $diff_history->render().
+        $diff_history->render(),
-        $warning.
+        $warning,
-        $local_view->render().
+        $local_view->render(),
-        $toc_view->render().
+        $toc_view->render(),
-        $other_view.
+        $other_view,
-        $changeset_view->render());
+        $changeset_view->render(),
+      ));
     if ($comment_form) {
       $page_pane->appendChild($comment_form->render());
     }
@@ -857,13 +858,12 @@ final class DifferentialRevisionViewController extends DifferentialController {
     $handles = $this->loadViewerHandles($phids);
     $view->setHandles($handles);
 
-    return
+    return hsprintf(
+      '%s<div class="differential-panel">%s</div>',
       id(new PhabricatorHeaderView())
         ->setHeader(pht('Open Revisions Affecting These Files'))
-        ->render().
+        ->render(),
-      '<div class="differential-panel">'.
+      $view->render());
-        $view->render().
-      '</div>';
   }
 
   /**

src/applications/differential/controller/DifferentialSubscribeController.php

@@ -43,7 +43,7 @@ final class DifferentialSubscribeController extends DifferentialController {
       $dialog
         ->setUser($user)
         ->setTitle($title)
-        ->appendChild('<p>'.$prompt.'</p>')
+        ->appendChild(phutil_tag('p', array(), $prompt))
         ->setSubmitURI($request->getRequestURI())
         ->addSubmitButton($button)
         ->addCancelButton('/D'.$revision->getID());

src/applications/differential/field/specification/DifferentialBlameRevisionFieldSpecification.php

@@ -49,7 +49,7 @@ final class DifferentialBlameRevisionFieldSpecification
       return null;
     }
     $engine = PhabricatorMarkupEngine::newDifferentialMarkupEngine();
-    return phutil_safe_html($engine->markupText($this->value));
+    return $engine->markupText($this->value);
   }
 
   public function shouldAppearOnConduitView() {

src/applications/differential/field/specification/DifferentialCommitsFieldSpecification.php

@@ -26,7 +26,7 @@ final class DifferentialCommitsFieldSpecification
       $links[] = $this->getHandle($commit_phid)->renderLink();
     }
 
-    return array_interleave(phutil_tag('br'), $links);
+    return phutil_implode_html(phutil_tag('br'), $links);
   }
 
   private function getCommitPHIDs() {

src/applications/differential/field/specification/DifferentialDependenciesFieldSpecification.php

@@ -26,7 +26,7 @@ final class DifferentialDependenciesFieldSpecification
       $links[] = $this->getHandle($revision_phids)->renderLink();
     }
 
-    return array_interleave(phutil_tag('br'), $links);
+    return phutil_implode_html(phutil_tag('br'), $links);
   }
 
   private function getDependentRevisionPHIDs() {

src/applications/differential/field/specification/DifferentialDependsOnFieldSpecification.php

@@ -26,7 +26,7 @@ final class DifferentialDependsOnFieldSpecification
       $links[] = $this->getHandle($revision_phids)->renderLink();
     }
 
-    return array_interleave(phutil_tag('br'), $links);
+    return phutil_implode_html(phutil_tag('br'), $links);
   }
 
   private function getDependentRevisionPHIDs() {

src/applications/differential/field/specification/DifferentialFieldSpecification.php

@@ -283,7 +283,7 @@ abstract class DifferentialFieldSpecification {
       $links[] = $handle->renderLink();
     }
 
-    return array_interleave(', ', $links);
+    return phutil_implode_html(', ', $links);
   }
 
 

src/applications/differential/field/specification/DifferentialManiphestTasksFieldSpecification.php

@@ -29,7 +29,7 @@ final class DifferentialManiphestTasksFieldSpecification
       $links[] = $this->getHandle($task_phid)->renderLink();
     }
 
-    return array_interleave(phutil_tag('br'), $links);
+    return phutil_implode_html(phutil_tag('br'), $links);
   }
 
   private function getManiphestTaskPHIDs() {

src/applications/differential/field/specification/DifferentialReviewersFieldSpecification.php

@@ -143,10 +143,9 @@ final class DifferentialReviewersFieldSpecification
       if ($other_reviewers) {
         $names = array();
         foreach ($other_reviewers as $reviewer => $_) {
-          $names[] = phutil_escape_html(
+          $names[] = $this->getHandle($reviewer)->getLinkName();
-            $this->getHandle($reviewer)->getLinkName());
         }
-        $suffix = ' '.javelin_tag(
+        $suffix = javelin_tag(
           'abbr',
           array(
             'sigil' => 'has-tooltip',
@@ -159,9 +158,12 @@ final class DifferentialReviewersFieldSpecification
       } else {
         $suffix = null;
       }
-      return $this->getHandle($primary_reviewer)->renderLink().$suffix;
+      return hsprintf(
+        '%s %s',
+        $this->getHandle($primary_reviewer)->renderLink(),
+        $suffix);
     } else {
-      return '<em>None</em>';
+      return phutil_tag('em', array(), 'None');
     }
   }
 

src/applications/differential/field/specification/DifferentialUnitFieldSpecification.php

@@ -113,7 +113,7 @@ final class DifferentialUnitFieldSpecification
         $userdata = idx($test, 'userdata');
         if ($userdata) {
           $engine = PhabricatorMarkupEngine::newDifferentialMarkupEngine();
-          $userdata = phutil_safe_html($engine->markupText($userdata));
+          $userdata = $engine->markupText($userdata);
           $rows[] = array(
             'style' => 'details',
             'value' => $userdata,

src/applications/differential/parser/DifferentialChangesetParser.php

@@ -1092,7 +1092,7 @@ final class DifferentialChangesetParser {
    * indicator of how well tested a change is.
    */
   public function renderModifiedCoverage() {
-    $na = '<em>-</em>';
+    $na = phutil_tag('em', array(), '-');
 
     $coverage = $this->getCoverage();
     if (!$coverage) {

src/applications/differential/render/DifferentialChangesetHTMLRenderer.php

@@ -21,27 +21,34 @@ abstract class DifferentialChangesetHTMLRenderer
         return null;
       }
     } else {
+      $none = $none;
       switch ($change) {
 
         case DifferentialChangeType::TYPE_ADD:
           switch ($file) {
             case DifferentialChangeType::FILE_TEXT:
-              $message = pht('This file was <strong>added</strong>.');
+              $message = pht('This file was <strong>added</strong>.', $none);
               break;
             case DifferentialChangeType::FILE_IMAGE:
-              $message = pht('This image was <strong>added</strong>.');
+              $message = pht('This image was <strong>added</strong>.', $none);
               break;
             case DifferentialChangeType::FILE_DIRECTORY:
-              $message = pht('This directory was <strong>added</strong>.');
+              $message = pht(
+                'This directory was <strong>added</strong>.',
+                $none);
               break;
             case DifferentialChangeType::FILE_BINARY:
-              $message = pht('This binary file was <strong>added</strong>.');
+              $message = pht(
+                'This binary file was <strong>added</strong>.',
+                $none);
               break;
             case DifferentialChangeType::FILE_SYMLINK:
-              $message = pht('This symlink was <strong>added</strong>.');
+              $message = pht('This symlink was <strong>added</strong>.', $none);
               break;
             case DifferentialChangeType::FILE_SUBMODULE:
-              $message = pht('This submodule was <strong>added</strong>.');
+              $message = pht(
+                'This submodule was <strong>added</strong>.',
+                $none);
               break;
           }
           break;
@@ -49,22 +56,30 @@ abstract class DifferentialChangesetHTMLRenderer
         case DifferentialChangeType::TYPE_DELETE:
           switch ($file) {
             case DifferentialChangeType::FILE_TEXT:
-              $message = pht('This file was <strong>deleted</strong>.');
+              $message = pht('This file was <strong>deleted</strong>.', $none);
               break;
             case DifferentialChangeType::FILE_IMAGE:
-              $message = pht('This image was <strong>deleted</strong>.');
+              $message = pht('This image was <strong>deleted</strong>.', $none);
               break;
             case DifferentialChangeType::FILE_DIRECTORY:
-              $message = pht('This directory was <strong>deleted</strong>.');
+              $message = pht(
+                'This directory was <strong>deleted</strong>.',
+                $none);
               break;
             case DifferentialChangeType::FILE_BINARY:
-              $message = pht('This binary file was <strong>deleted</strong>.');
+              $message = pht(
+                'This binary file was <strong>deleted</strong>.',
+                $none);
               break;
             case DifferentialChangeType::FILE_SYMLINK:
-              $message = pht('This symlink was <strong>deleted</strong>.');
+              $message = pht(
+                'This symlink was <strong>deleted</strong>.',
+                $none);
               break;
             case DifferentialChangeType::FILE_SUBMODULE:
-              $message = pht('This submodule was <strong>deleted</strong>.');
+              $message = pht(
+                'This submodule was <strong>deleted</strong>.',
+                $none);
               break;
           }
           break;
@@ -235,10 +250,9 @@ abstract class DifferentialChangesetHTMLRenderer
       }
     }
 
-    return
+    return hsprintf(
-      '<div class="differential-meta-notice">'.
+      '<div class="differential-meta-notice">%s</div>',
-        $message.
+      $message);
-      '</div>';
   }
 
   protected function renderPropertyChangeHeader() {
@@ -279,15 +293,20 @@ abstract class DifferentialChangesetHTMLRenderer
       }
     }
 
-    return
+    array_unshift($rows, hsprintf(
-      '<table class="differential-property-table">'.
       '<tr class="property-table-header">'.
-          '<th>'.pht('Property Changes').'</th>'.
+        '<th>%s</th>'.
-          '<td class="oval">'.pht('Old Value').'</td>'.
+        '<td class="oval">%s</td>'.
-          '<td class="nval">'.pht('New Value').'</td>'.
+        '<td class="nval">%s</td>'.
-        '</tr>'.
+      '</tr>',
-        implode('', $rows).
+      pht('Property Changes'),
-      '</table>';
+      pht('Old Value'),
+      pht('New Value')));
+
+    return phutil_tag(
+      'table',
+      array('class' => 'differential-property-table'),
+      $rows);
   }
 
   public function renderShield($message, $force = 'default') {
@@ -352,9 +371,6 @@ abstract class DifferentialChangesetHTMLRenderer
       return null;
     }
 
-    // TODO: [HTML] After TwoUpRenderer gets refactored, fix this.
-    $content = phutil_safe_html($content);
-
     return javelin_tag(
       'table',
       array(

src/applications/differential/render/DifferentialChangesetOneUpRenderer.php

@@ -20,32 +20,32 @@ final class DifferentialChangesetOneUpRenderer
       switch ($type) {
         case 'old':
         case 'new':
-          $out[] = '<tr>';
+          $out[] = hsprintf('<tr>');
           if ($type == 'old') {
             if ($p['htype']) {
               $class = 'left old';
             } else {
               $class = 'left';
             }
-            $out[] = '<th>'.$p['line'].'</th>';
+            $out[] = hsprintf('<th>%s</th>', $p['line']);
-            $out[] = '<th></th>';
+            $out[] = hsprintf('<th></th>');
-            $out[] = '<td class="'.$class.'">'.$p['render'].'</td>';
+            $out[] = hsprintf('<td class="%s">%s</td>', $class, $p['render']);
           } else if ($type == 'new') {
             if ($p['htype']) {
               $class = 'right new';
-              $out[] = '<th />';
+              $out[] = hsprintf('<th />');
             } else {
               $class = 'right';
-              $out[] = '<th>'.$p['oline'].'</th>';
+              $out[] = hsprintf('<th>%s</th>', $p['oline']);
             }
-            $out[] = '<th>'.$p['line'].'</th>';
+            $out[] = hsprintf('<th>%s</th>', $p['line']);
-            $out[] = '<td class="'.$class.'">'.$p['render'].'</td>';
+            $out[] = hsprintf('<td class="%s">%s</td>', $class, $p['render']);
           }
-          $out[] = '</tr>';
+          $out[] = hsprintf('</tr>');
           break;
         case 'inline':
-          $out[] = '<tr><th /><th />';
+          $out[] = hsprintf('<tr><th /><th />');
-          $out[] = '<td>';
+          $out[] = hsprintf('<td>');
 
           $inline = $this->buildInlineComment(
             $p['comment'],
@@ -53,16 +53,16 @@ final class DifferentialChangesetOneUpRenderer
           $inline->setBuildScaffolding(false);
           $out[] = $inline->render();
 
-          $out[] = '</td></tr>';
+          $out[] = hsprintf('</td></tr>');
           break;
         default:
-          $out[] = '<tr><th /><th /><td>'.$type.'</td></tr>';
+          $out[] = hsprintf('<tr><th /><th /><td>%s</td></tr>', $type);
           break;
       }
     }
 
     if ($out) {
-      return $this->wrapChangeInTable(implode('', $out));
+      return $this->wrapChangeInTable(phutil_implode_html('', $out));
     }
     return null;
   }

src/applications/differential/render/DifferentialChangesetTwoUpRenderer.php

@@ -160,7 +160,7 @@ final class DifferentialChangesetTwoUpRenderer
                 'colspan' => 2,
                 'class' => 'show-more',
               ),
-              array_interleave(
+              phutil_implode_html(
                 " \xE2\x80\xA2 ", // Bullet
                 $contents)),
             phutil_tag(
@@ -205,7 +205,7 @@ final class DifferentialChangesetTwoUpRenderer
         }
       }
 
-      $n_copy = '<td class="copy" />';
+      $n_copy = hsprintf('<td class="copy" />');
       $n_cov = null;
       $n_colspan = 2;
       $n_classes = '';
@@ -224,7 +224,7 @@ final class DifferentialChangesetTwoUpRenderer
             $cov_class = $coverage[$n_num - 1];
           }
           $cov_class = 'cov-'.$cov_class;
-          $n_cov = '<td class="cov '.$cov_class.'"></td>';
+          $n_cov = hsprintf('<td class="cov %s"></td>', $cov_class);
           $n_colspan--;
         }
 
@@ -242,7 +242,7 @@ final class DifferentialChangesetTwoUpRenderer
           $n_classes = $n_class;
 
           if ($new_lines[$ii]['type'] == '\\' || !isset($copy_lines[$n_num])) {
-            $n_copy = '<td class="copy '.$n_class.'"></td>';
+            $n_copy = hsprintf('<td class="copy %s"></td>', $n_class);
           } else {
             list($orig_file, $orig_line, $orig_type) = $copy_lines[$n_num];
             $title = ($orig_type == '-' ? 'Moved' : 'Copied').' from ';
@@ -274,13 +274,13 @@ final class DifferentialChangesetTwoUpRenderer
       }
 
       if ($o_num && $left_id) {
-        $o_id = ' id="C'.$left_id.$left_char.'L'.$o_num.'"';
+        $o_id = 'C'.$left_id.$left_char.'L'.$o_num;
       } else {
         $o_id = null;
       }
 
       if ($n_num && $right_id) {
-        $n_id = ' id="C'.$right_id.$right_char.'L'.$n_num.'"';
+        $n_id = 'C'.$right_id.$right_char.'L'.$n_num;
       } else {
         $n_id = null;
       }
@@ -288,20 +288,26 @@ final class DifferentialChangesetTwoUpRenderer
       // NOTE: The Javascript is sensitive to whitespace changes in this
       // block!
 
-      $html[] =
+      $html[] = hsprintf(
         '<tr>'.
-          '<th'.$o_id.'>'.$o_num.'</th>'.
+          '%s'.
-          '<td class="'.$o_classes.'">'.$o_text.'</td>'.
+          '<td class="%s">%s</td>'.
-          '<th'.$n_id.'>'.$n_num.'</th>'.
+          '%s'.
-          $n_copy.
+          '%s'.
           // NOTE: This is a unicode zero-width space, which we use as a hint
           // when intercepting 'copy' events to make sure sensible text ends
           // up on the clipboard. See the 'phabricator-oncopy' behavior.
-          '<td class="'.$n_classes.'" colspan="'.$n_colspan.'">'.
+          '<td class="%s" colspan="%s">'.
-            "\xE2\x80\x8B".$n_text.
+            "\xE2\x80\x8B%s".
           '</td>'.
-          $n_cov.
+          '%s'.
-        '</tr>';
+        '</tr>',
+        phutil_tag('th', array('id' => $o_id), $o_num),
+        $o_classes, $o_text,
+        phutil_tag('th', array('id' => $n_id), $n_num),
+        $n_copy,
+        $n_classes, $n_colspan, $n_text,
+        $n_cov);
 
       if ($context_not_available && ($ii == $rows - 1)) {
         $html[] = $context_not_available;
@@ -351,7 +357,7 @@ final class DifferentialChangesetTwoUpRenderer
       }
     }
 
-    return $this->wrapChangeInTable(implode('', $html));
+    return $this->wrapChangeInTable(phutil_implode_html('', $html));
   }
 
   public function renderFileChange($old_file = null,
@@ -395,51 +401,57 @@ final class DifferentialChangesetTwoUpRenderer
     foreach ($this->getOldComments() as $on_line => $comment_group) {
       foreach ($comment_group as $comment) {
         $comment_html = $this->renderInlineComment($comment, $on_right = false);
-        $html_old[] =
+        $html_old[] = hsprintf(
           '<tr class="inline">'.
           '<th />'.
-          '<td class="left">'.$comment_html.'</td>'.
+          '<td class="left">%s</td>'.
           '<th />'.
           '<td class="right3" colspan="3" />'.
-          '</tr>';
+          '</tr>',
+          $comment_html);
       }
     }
     foreach ($this->getNewComments() as $lin_line => $comment_group) {
       foreach ($comment_group as $comment) {
         $comment_html = $this->renderInlineComment($comment, $on_right = true);
-        $html_new[] =
+        $html_new[] = hsprintf(
           '<tr class="inline">'.
           '<th />'.
           '<td class="left" />'.
           '<th />'.
-          '<td class="right3" colspan="3">'.$comment_html.'</td>'.
+          '<td class="right3" colspan="3">%s</td>'.
-          '</tr>';
+          '</tr>',
+          $comment_html);
       }
     }
 
     if (!$old) {
-      $th_old = '<th></th>';
+      $th_old = hsprintf('<th></th>');
     } else {
-      $th_old = '<th id="C'.$vs.'OL1">1</th>';
+      $th_old = hsprintf('<th id="C%sOL1">1</th>', $vs);
     }
 
     if (!$new) {
-      $th_new = '<th></th>';
+      $th_new = hsprintf('<th></th>');
     } else {
-      $th_new = '<th id="C'.$id.'NL1">1</th>';
+      $th_new = hsprintf('<th id="C%sNL1">1</th>', $id);
     }
 
-    $output =
+    $output = hsprintf(
       '<tr class="differential-image-diff">'.
-      $th_old.
+        '%s'.
-      '<td class="left differential-old-image">'.$old.'</td>'.
+        '<td class="left differential-old-image">%s</td>'.
-      $th_new.
+        '%s'.
-      '<td class="right3 differential-new-image" colspan="3">'.
+        '<td class="right3 differential-new-image" colspan="3">%s</td>'.
-      $new.
-      '</td>'.
       '</tr>'.
-      implode('', $html_old).
+      '%s'.
-      implode('', $html_new);
+      '%s',
+      $th_old,
+      $old,
+      $th_new,
+      $new,
+      phutil_implode_html('', $html_old),
+      phutil_implode_html('', $html_new));
 
     $output = $this->wrapChangeInTable($output);
 

src/applications/differential/view/DifferentialAddCommentView.php

@@ -155,35 +155,35 @@ final class DifferentialAddCommentView extends AphrontView {
         'inline'    => 'inline-comment-preview',
       ));
 
-    $warning_container = '<div id="warnings">';
+    $warning_container = array();
     foreach ($warnings as $warning) {
       if ($warning) {
-        $warning_container .= $warning->render();
+        $warning_container[] = $warning->render();
       }
     }
-    $warning_container .= '</div>';
 
     $header = id(new PhabricatorHeaderView())
       ->setHeader($is_serious ? pht('Add Comment') : pht('Leap Into Action'));
 
-    return
+    return hsprintf(
-      id(new PhabricatorAnchorView())
+      '%s'.
-        ->setAnchorName('comment')
-        ->setNavigationMarker(true)
-        ->render().
       '<div class="differential-add-comment-panel">'.
-        $header->render().
+        '%s%s%s'.
-        $form->render().
-        $warning_container.
         '<div class="aphront-panel-preview aphront-panel-flush">'.
           '<div id="comment-preview">'.
-            '<span class="aphront-panel-preview-loading-text">'.
+            '<span class="aphront-panel-preview-loading-text">%s</span>'.
-              pht('Loading comment preview...').
-            '</span>'.
           '</div>'.
           '<div id="inline-comment-preview">'.
           '</div>'.
         '</div>'.
-      '</div>';
+      '</div>',
+      id(new PhabricatorAnchorView())
+        ->setAnchorName('comment')
+        ->setNavigationMarker(true)
+        ->render(),
+      $header->render(),
+      $form->render(),
+      phutil_tag('div', array('id' => 'warnings'), $warning_container),
+      pht('Loading comment preview...'));
   }
 }

src/applications/differential/view/DifferentialChangesetDetailView.php

@@ -92,7 +92,7 @@ final class DifferentialChangesetDetailView extends AphrontView {
         'class' => $class,
         'id'    => $id,
       ),
-      $this->renderHTMLView(
+      $this->renderSingleView(
         array(
           id(new PhabricatorAnchorView())
             ->setAnchorName($changeset->getAnchorName())
@@ -101,7 +101,7 @@ final class DifferentialChangesetDetailView extends AphrontView {
           $buttons,
           phutil_tag('h1', array(), $display_filename),
           phutil_tag('div', array('style' => 'clear: both'), ''),
-          $this->renderHTMLChildren(),
+          $this->renderChildren(),
         )));
   }
 

src/applications/differential/view/DifferentialChangesetListView.php

@@ -187,7 +187,7 @@ final class DifferentialChangesetListView extends AphrontView {
       ));
     }
 
-    return $this->renderHTMLView(
+    return $this->renderSingleView(
       array(
         id(new PhabricatorHeaderView())
           ->setHeader($this->getTitle())
@@ -221,15 +221,20 @@ final class DifferentialChangesetListView extends AphrontView {
       ),
       array('Changes discarded. ', $link));
 
-    $template =
+    return array(
+      'l' => hsprintf(
         '<table><tr>'.
           '<th></th><td>%s</td>'.
-      '<th></th><td colspan="3">%s</td>'.
+          '<th></th><td colspan="3"></td>'.
-      '</tr></table>';
+        '</tr></table>',
+        $div),
 
-    return array(
+      'r' => hsprintf(
-      'l' => sprintf($template, $div, ''),
+        '<table><tr>'.
-      'r' => sprintf($template, '', $div),
+          '<th></th><td></td>'.
+          '<th></th><td colspan="3">%s</td>'.
+        '</tr></table>',
+        $div),
     );
   }
 

src/applications/differential/view/DifferentialDiffTableOfContentsView.php

@@ -94,22 +94,20 @@ final class DifferentialDiffTableOfContentsView extends AphrontView {
             $meta[] = pht('Copied to multiple locations:');
           }
           foreach ($away as $path) {
-            $meta[] = phutil_escape_html($path);
+            $meta[] = $path;
           }
-          $meta = implode('<br />', $meta);
+          $meta = phutil_implode_html(phutil_tag('br'), $meta);
         } else {
           if ($type == DifferentialChangeType::TYPE_MOVE_AWAY) {
-            $meta = pht('Moved to %s', phutil_escape_html(reset($away)));
+            $meta = pht('Moved to %s', reset($away));
           } else {
-            $meta = pht('Copied to %s', phutil_escape_html(reset($away)));
+            $meta = pht('Copied to %s', reset($away));
           }
         }
       } else if ($type == DifferentialChangeType::TYPE_MOVE_HERE) {
-        $meta = pht('Moved from %s',
+        $meta = pht('Moved from %s', $changeset->getOldFile());
-          phutil_escape_html($changeset->getOldFile()));
       } else if ($type == DifferentialChangeType::TYPE_COPY_HERE) {
-        $meta = pht('Copied from %s',
+        $meta = pht('Copied from %s', $changeset->getOldFile());
-          phutil_escape_html($changeset->getOldFile()));
       } else {
         $meta = null;
       }
@@ -130,12 +128,12 @@ final class DifferentialDiffTableOfContentsView extends AphrontView {
       $pchar =
         ($changeset->getOldProperties() === $changeset->getNewProperties())
           ? null
-          : '<span title="'.pht('Properties Changed').'">M</span>';
+          : hsprintf('<span title="%s">M</span>', pht('Properties Changed'));
 
       $fname = $changeset->getFilename();
       $cov  = $this->renderCoverage($coverage, $fname);
       if ($cov === null) {
-        $mcov = $cov = '<em>-</em>';
+        $mcov = $cov = phutil_tag('em', array(), '-');
       } else {
         $mcov = phutil_tag(
           'div',
@@ -146,27 +144,28 @@ final class DifferentialDiffTableOfContentsView extends AphrontView {
           (isset($this->visibleChangesets[$id]) ? 'Loading...' : '?'));
       }
 
-      $rows[] =
+      $rows[] = hsprintf(
           '<tr>'.
-          phutil_tag(
+            '<td class="differential-toc-char" title="%s">%s</td>'.
-            'td',
+            '<td class="differential-toc-prop">%s</td>'.
-            array(
+            '<td class="differential-toc-ftype">%s</td>'.
-              'class' => 'differential-toc-char',
+            '<td class="differential-toc-file">%s%s</td>'.
-              'title' => $chartitle,
+            '<td class="differential-toc-cov">%s</td>'.
-            ),
+            '<td class="differential-toc-mcov">%s</td>'.
-            $char).
+          '</tr>',
-          '<td class="differential-toc-prop">'.$pchar.'</td>'.
+          $chartitle, $char,
-          '<td class="differential-toc-ftype">'.$desc.'</td>'.
+          $pchar,
-          '<td class="differential-toc-file">'.$link.$lines.'</td>'.
+          $desc,
-          '<td class="differential-toc-cov">'.$cov.'</td>'.
+          $link, $lines,
-          '<td class="differential-toc-mcov">'.$mcov.'</td>'.
+          $cov,
-        '</tr>';
+          $mcov);
       if ($meta) {
-        $rows[] =
+        $rows[] = hsprintf(
           '<tr>'.
             '<td colspan="3"></td>'.
-            '<td class="differential-toc-meta">'.$meta.'</td>'.
+            '<td class="differential-toc-meta">%s</td>'.
-          '</tr>';
+          '</tr>',
+          $meta);
       }
       if ($this->diff && $this->repository) {
         $paths[] =
@@ -201,19 +200,13 @@ final class DifferentialDiffTableOfContentsView extends AphrontView {
         ),
         pht('Show All Context'));
 
-    $buttons =
+    $buttons = hsprintf(
-      '<tr><td colspan="7">'.
+      '<tr><td colspan="7">%s%s</td></tr>',
-        $editor_link.$reveal_link.
+      $editor_link,
-      '</td></tr>';
+      $reveal_link);
 
-    return
+    return hsprintf(
-      id(new PhabricatorAnchorView())
+      '%s%s'.
-        ->setAnchorName('toc')
-        ->setNavigationMarker(true)
-        ->render().
-      id(new PhabricatorHeaderView())
-        ->setHeader(pht('Table of Contents'))
-        ->render().
       '<div class="differential-toc differential-panel">'.
         '<table>'.
           '<tr>'.
@@ -221,17 +214,23 @@ final class DifferentialDiffTableOfContentsView extends AphrontView {
             '<th></th>'.
             '<th></th>'.
             '<th>Path</th>'.
-            '<th class="differential-toc-cov">'.
+            '<th class="differential-toc-cov">%s</th>'.
-              pht('Coverage (All)').
+            '<th class="differential-toc-mcov">%s</th>'.
-            '</th>'.
-            '<th class="differential-toc-mcov">'.
-              pht('Coverage (Touched)').
-            '</th>'.
           '</tr>'.
-          implode("\n", $rows).
+          '%s%s'.
-          $buttons.
         '</table>'.
-      '</div>';
+      '</div>',
+      id(new PhabricatorAnchorView())
+        ->setAnchorName('toc')
+        ->setNavigationMarker(true)
+        ->render(),
+      id(new PhabricatorHeaderView())
+        ->setHeader(pht('Table of Contents'))
+        ->render(),
+      pht('Coverage (All)'),
+      pht('Coverage (Touched)'),
+      phutil_implode_html("\n", $rows),
+      $buttons);
   }
 
   private function renderCoverage(array $coverage, $file) {

src/applications/differential/view/DifferentialInlineCommentEditView.php

@@ -55,7 +55,7 @@ final class DifferentialInlineCommentEditView extends AphrontView {
         'method'    => 'POST',
         'sigil'     => 'inline-edit-form',
       ),
-      $this->renderHTMLView(
+      $this->renderSingleView(
         array(
           $this->renderInputs(),
           $this->renderBody(),
@@ -123,14 +123,14 @@ final class DifferentialInlineCommentEditView extends AphrontView {
       array(
         'class' => 'differential-inline-comment-edit-body',
       ),
-      $this->renderHTMLChildren());
+      $this->renderChildren());
 
     $edit = phutil_tag(
       'edit',
       array(
         'class' => 'differential-inline-comment-edit-buttons',
       ),
-      $this->renderHTMLView(
+      $this->renderSingleView(
         array(
           $formatting,
           $buttons,
@@ -148,7 +148,7 @@ final class DifferentialInlineCommentEditView extends AphrontView {
           'length' => $this->length,
         ),
       ),
-      $this->renderHTMLView(
+      $this->renderSingleView(
         array(
           $title,
           $body,

src/applications/differential/view/DifferentialInlineCommentView.php

@@ -178,7 +178,7 @@ final class DifferentialInlineCommentView extends AphrontView {
       $links = phutil_tag(
         'span',
         array('class' => 'differential-inline-comment-links'),
-        array_interleave(" \xC2\xB7 ", $links));
+        phutil_implode_html(" \xC2\xB7 ", $links));
     } else {
       $links = null;
     }

src/applications/differential/view/DifferentialLocalCommitsView.php

@@ -74,7 +74,7 @@ final class DifferentialLocalCommitsView extends AphrontView {
         }
         $parents[$k] = substr($parent, 0, 16);
       }
-      $parents = array_interleave(phutil_tag('br'), $parents);
+      $parents = phutil_implode_html(phutil_tag('br'), $parents);
       $row[] = phutil_tag('td', array(), $parents);
 
       $author = nonempty(
@@ -114,29 +114,31 @@ final class DifferentialLocalCommitsView extends AphrontView {
 
 
     $headers = array();
-    $headers[] = '<th>'.pht('Commit').'</th>';
+    $headers[] = phutil_tag('th', array(), pht('Commit'));
     if ($has_tree) {
-      $headers[] = '<th>'.pht('Tree').'</th>';
+      $headers[] = phutil_tag('th', array(), pht('Tree'));
     }
     if ($has_local) {
-      $headers[] = '<th>'.pht('Local').'</th>';
+      $headers[] = phutil_tag('th', array(), pht('Local'));
     }
-    $headers[] = '<th>'.pht('Parents').'</th>';
+    $headers[] = phutil_tag('th', array(), pht('Parents'));
-    $headers[] = '<th>'.pht('Author').'</th>';
+    $headers[] = phutil_tag('th', array(), pht('Author'));
-    $headers[] = '<th>'.pht('Summary').'</th>';
+    $headers[] = phutil_tag('th', array(), pht('Summary'));
-    $headers[] = '<th>'.pht('Date').'</th>';
+    $headers[] = phutil_tag('th', array(), pht('Date'));
 
-    $headers = '<tr>'.implode('', $headers).'</tr>';
+    $headers = phutil_tag('tr', array(), $headers);
 
-    return
+    $header = id(new PhabricatorHeaderView())
-      id(new PhabricatorHeaderView())
       ->setHeader(pht('Local Commits'))
-        ->render().
+      ->render();
+
+    return hsprintf(
+      '%s'.
       '<div class="differential-panel">'.
-        '<table class="differential-local-commits-table">'.
+        '<table class="differential-local-commits-table">%s%s</table>'.
-          $headers.
+      '</div>',
-          implode("\n", $rows).
+      $header,
-        '</table>'.
+      $headers,
-      '</div>';
+      phutil_implode_html("\n", $rows));
   }
 }

src/applications/differential/view/DifferentialPrimaryPaneView.php

@@ -11,7 +11,7 @@ final class DifferentialPrimaryPaneView extends AphrontView {
 
   public function render() {
 
-    return phutil_render_tag(
+    return phutil_tag(
       'div',
       array(
         'class' => 'differential-primary-pane',

src/applications/differential/view/DifferentialRevisionCommentListView.php

@@ -187,14 +187,12 @@ final class DifferentialRevisionCommentListView extends AphrontView {
       $hidden = null;
     }
 
-    return javelin_render_tag(
+    return javelin_tag(
       'div',
       array(
         'class' => 'differential-comment-list',
         'id' => $this->getID(),
       ),
-      implode("\n", $header).
+      array_merge($header, array($hidden), $visible));
-      $hidden.
-      implode("\n", $visible));
   }
 }

src/applications/differential/view/DifferentialRevisionCommentView.php

@@ -87,10 +87,9 @@ final class DifferentialRevisionCommentView extends AphrontView {
         $comment,
         PhabricatorInlineCommentInterface::MARKUP_FIELD_BODY);
 
-      $content =
+      $content = hsprintf(
-        '<div class="phabricator-remarkup">'.
+        '<div class="phabricator-remarkup">%s</div>',
-          $content.
+        $content);
-        '</div>';
     }
 
     $inline_render = $this->renderInlineComments();
@@ -116,19 +115,22 @@ final class DifferentialRevisionCommentView extends AphrontView {
       array());
 
     $verb = DifferentialAction::getActionPastTenseVerb($comment->getAction());
-    $verb = phutil_escape_html($verb);
 
     $actions = array();
     // TODO: i18n
     switch ($comment->getAction()) {
       case DifferentialAction::ACTION_ADDCCS:
-        $actions[] = "{$author_link} added CCs: ".
+        $actions[] = hsprintf(
-          $this->renderHandleList($added_ccs).".";
+          "%s added CCs: %s.",
+          $author_link,
+          $this->renderHandleList($added_ccs));
         $added_ccs = null;
         break;
       case DifferentialAction::ACTION_ADDREVIEWERS:
-        $actions[] = "{$author_link} added reviewers: ".
+        $actions[] = hsprintf(
-          $this->renderHandleList($added_reviewers).".";
+          "%s added reviewers: %s.",
+          $author_link,
+          $this->renderHandleList($added_reviewers));
         $added_reviewers = null;
         break;
       case DifferentialAction::ACTION_UPDATE:
@@ -140,33 +142,48 @@ final class DifferentialRevisionCommentView extends AphrontView {
               'href' => '/D'.$comment->getRevisionID().'?id='.$diff_id,
             ),
             'Diff #'.$diff_id);
-          $actions[] = "{$author_link} updated this revision to {$diff_link}.";
+          $actions[] = hsprintf(
+            "%s updated this revision to %s.",
+            $author_link,
+            $diff_link);
         } else {
-          $actions[] = "{$author_link} {$verb} this revision.";
+          $actions[] = hsprintf(
+            "%s %s this revision.",
+            $author_link,
+            $verb);
         }
         break;
       default:
-        $actions[] = "{$author_link} {$verb} this revision.";
+        $actions[] = hsprintf(
+          "%s %s this revision.",
+          $author_link,
+          $verb);
         break;
     }
 
     if ($added_reviewers) {
-      $actions[] = "{$author_link} added reviewers: ".
+      $actions[] = hsprintf(
-        $this->renderHandleList($added_reviewers).".";
+        "%s added reviewers: %s.",
+        $author_link,
+        $this->renderHandleList($added_reviewers));
     }
 
     if ($removed_reviewers) {
-      $actions[] = "{$author_link} removed reviewers: ".
+      $actions[] = hsprintf(
-        $this->renderHandleList($removed_reviewers).".";
+        "%s removed reviewers: %s.",
+        $author_link,
+        $this->renderHandleList($removed_reviewers));
     }
 
     if ($added_ccs) {
-      $actions[] = "{$author_link} added CCs: ".
+      $actions[] = hsprintf(
-        $this->renderHandleList($added_ccs).".";
+        "%s added CCs: %s.",
+        $author_link,
+        $this->renderHandleList($added_ccs));
     }
 
     foreach ($actions as $key => $action) {
-      $actions[$key] = '<div>'.$action.'</div>';
+      $actions[$key] = phutil_tag('div', array(), $action);
     }
 
     $xaction_view = id(new PhabricatorTransactionView())
@@ -190,11 +207,10 @@ final class DifferentialRevisionCommentView extends AphrontView {
     }
 
     if (!$hide_comments) {
-      $xaction_view->appendChild(
+      $xaction_view->appendChild(hsprintf(
-        '<div class="differential-comment-core">'.
+        '<div class="differential-comment-core">%s%s</div>',
-          $content.
+        $content,
-        '</div>'.
+        $this->renderSingleView($inline_render)));
-        $this->renderSingleView($inline_render));
     }
 
     return $xaction_view->render();
@@ -205,7 +221,7 @@ final class DifferentialRevisionCommentView extends AphrontView {
     foreach ($phids as $phid) {
       $result[] = $this->handles[$phid]->renderLink();
     }
-    return implode(', ', $result);
+    return phutil_implode_html(', ', $result);
   }
 
   private function renderInlineComments() {

src/applications/differential/view/DifferentialRevisionDetailView.php

@@ -87,7 +87,11 @@ final class DifferentialRevisionDetailView extends AphrontView {
     }
     $properties->setHasKeyboardShortcuts(true);
 
-    return $header->render() . $actions->render() . $properties->render();
+    return hsprintf(
+      '%s%s%s',
+      $header->render(),
+      $actions->render(),
+      $properties->render());
   }
 
   private function renderHeader(DifferentialRevision $revision) {

src/applications/differential/view/DifferentialRevisionListView.php

@@ -128,8 +128,9 @@ final class DifferentialRevisionListView extends AphrontView {
 
       } else if (array_key_exists($revision->getID(), $this->drafts)) {
         $src = '/rsrc/image/icon/fatcow/page_white_edit.png';
-        $flag =
+        $flag = hsprintf(
-          '<a href="/D'.$revision->getID().'#comment-preview">'.
+          '<a href="%s">%s</a>',
+          '/D'.$revision->getID().'#comment-preview',
           phutil_tag(
             'img',
             array(
@@ -138,8 +139,7 @@ final class DifferentialRevisionListView extends AphrontView {
               'height' => 16,
               'alt' => 'Draft',
               'title' => pht('Draft Comment'),
-              )).
+            )));
-            '</a>';
       }
 
       $row = array($flag);

src/applications/differential/view/DifferentialRevisionUpdateHistoryView.php

@@ -177,9 +177,8 @@ final class DifferentialRevisionUpdateHistoryView extends AphrontView {
       DifferentialChangesetParser::WHITESPACE_SHOW_ALL => 'Show All',
     );
 
-    $select = '<select name="whitespace">';
     foreach ($options as $value => $label) {
-      $select .= phutil_tag(
+      $options[$value] = phutil_tag(
         'option',
         array(
           'value' => $value,
@@ -189,34 +188,39 @@ final class DifferentialRevisionUpdateHistoryView extends AphrontView {
         ),
         $label);
     }
-    $select .= '</select>';
+    $select = phutil_tag('select', array('name' => 'whitespace'), $options);
 
-    return
+    array_unshift($rows, phutil_tag('tr', array(), array(
-      id(new PhabricatorHeaderView())
+      phutil_tag('th', array(), pht('Diff')),
-        ->setHeader(pht('Revision Update History'))
+      phutil_tag('th', array(), pht('ID')),
-        ->render() .
+      phutil_tag('th', array(), pht('Base')),
+      phutil_tag('th', array(), pht('Description')),
+      phutil_tag('th', array(), pht('Created')),
+      phutil_tag('th', array(), pht('Lint')),
+      phutil_tag('th', array(), pht('Unit')),
+    )));
+
+    return hsprintf(
+      '%s'.
       '<div class="differential-revision-history differential-panel">'.
         '<form action="#toc">'.
           '<table class="differential-revision-history-table">'.
-            '<tr>'.
+            '%s'.
-              '<th>'.pht('Diff').'</th>'.
-              '<th>'.pht('ID').'</th>'.
-              '<th>'.pht('Base').'</th>'.
-              '<th>'.pht('Description').'</th>'.
-              '<th>'.pht('Created').'</th>'.
-              '<th>'.pht('Lint').'</th>'.
-              '<th>'.pht('Unit').'</th>'.
-            '</tr>'.
-            implode("\n", $rows).
             '<tr>'.
               '<td colspan="9" class="diff-differ-submit">'.
-                '<label>'.pht('Whitespace Changes: %s', $select).'</label>'.
+                '<label>%s</label>'.
-                '<button>'.pht('Show Diff').'</button>'.
+                '<button>%s</button>'.
               '</td>'.
             '</tr>'.
           '</table>'.
         '</form>'.
-      '</div>';
+      '</div>',
+      id(new PhabricatorHeaderView())
+        ->setHeader(pht('Revision Update History'))
+        ->render(),
+      phutil_implode_html("\n", $rows),
+      pht('Whitespace Changes: %s', $select),
+      pht('Show Diff'));
   }
 
   const STAR_NONE = 'none';

src/applications/diffusion/controller/DiffusionBrowseController.php

@@ -21,7 +21,7 @@ final class DiffusionBrowseController extends DiffusionController {
       $title = 'Tag: '.$drequest->getSymbolicCommit();
 
       $tag_view = new AphrontPanelView();
-      $tag_view->setHeader(phutil_escape_html($title));
+      $tag_view->setHeader($title);
       $tag_view->appendChild(
         $this->markupText($drequest->getTagContent()));
 
@@ -106,7 +106,7 @@ final class DiffusionBrowseController extends DiffusionController {
 
   private function markupText($text) {
     $engine = PhabricatorMarkupEngine::newDiffusionMarkupEngine();
-    $text = phutil_safe_html($engine->markupText($text));
+    $text = $engine->markupText($text);
 
     $text = phutil_tag(
       'div',

src/applications/diffusion/controller/DiffusionCommitController.php

@@ -97,8 +97,7 @@ final class DiffusionCommitController extends DiffusionController {
           array(
             'class' => 'diffusion-commit-message phabricator-remarkup',
           ),
-          phutil_safe_html(
+          $engine->markupText($commit_data->getCommitMessage())));
-            $engine->markupText($commit_data->getCommitMessage()))));
 
       $content[] = $top_anchor;
       $content[] = $headsup_view;
@@ -449,9 +448,7 @@ final class DiffusionCommitController extends DiffusionController {
       foreach ($parents as $parent) {
         $parent_links[] = $handles[$parent->getPHID()]->renderLink();
       }
-      $props['Parents'] = array_interleave(
+      $props['Parents'] = phutil_implode_html(" \xC2\xB7 ", $parent_links);
-        " \xC2\xB7 ",
-        $parent_links);
     }
 
     $request = $this->getDiffusionRequest();
@@ -488,7 +485,7 @@ final class DiffusionCommitController extends DiffusionController {
       foreach ($task_phids as $phid) {
         $task_list[] = $handles[$phid]->renderLink();
       }
-      $task_list = array_interleave(phutil_tag('br'), $task_list);
+      $task_list = phutil_implode_html(phutil_tag('br'), $task_list);
       $props['Tasks'] = $task_list;
     }
 
@@ -497,7 +494,7 @@ final class DiffusionCommitController extends DiffusionController {
       foreach ($proj_phids as $phid) {
         $proj_list[] = $handles[$phid]->renderLink();
       }
-      $proj_list = array_interleave(phutil_tag('br'), $proj_list);
+      $proj_list = phutil_implode_html(phutil_tag('br'), $proj_list);
       $props['Projects'] = $proj_list;
     }
 
@@ -689,7 +686,7 @@ final class DiffusionCommitController extends DiffusionController {
       'inlineuri'  => '/diffusion/inline/preview/'.$commit->getPHID().'/',
     ));
 
-    $preview_panel =
+    $preview_panel = hsprintf(
       '<div class="aphront-panel-preview aphront-panel-flush">
         <div id="audit-preview">
           <div class="aphront-panel-preview-loading-text">
@@ -698,27 +695,24 @@ final class DiffusionCommitController extends DiffusionController {
         </div>
         <div id="inline-comment-preview">
         </div>
-      </div>';
+      </div>');
 
     // TODO: This is pretty awkward, unify the CSS between Diffusion and
     // Differential better.
     require_celerity_resource('differential-core-view-css');
 
-    return phutil_render_tag(
+    return phutil_tag(
       'div',
       array(
         'id' => $pane_id,
       ),
-      phutil_render_tag(
+      hsprintf(
-        'div',
+        '<div class="differential-add-comment-panel">%s%s%s</div>',
-        array(
-          'class' => 'differential-add-comment-panel',
-        ),
         id(new PhabricatorAnchorView())
           ->setAnchorName('comment')
           ->setNavigationMarker(true)
-          ->render().
+          ->render(),
-        $panel->render().
+        $panel->render(),
         $preview_panel));
   }
 
@@ -938,7 +932,7 @@ final class DiffusionCommitController extends DiffusionController {
         $ref);
     }
 
-    return array_interleave(', ', $ref_links);
+    return phutil_implode_html(', ', $ref_links);
   }
 
   private function buildRawDiffResponse(DiffusionRequest $drequest) {

src/applications/diffusion/controller/DiffusionExternalController.php

@@ -103,7 +103,7 @@ final class DiffusionExternalController extends DiffusionController {
               'href' => $href,
             ),
               'r'.$repo->getCallsign().$commit->getCommitIdentifier()),
-          phutil_escape_html($commit->loadCommitData()->getSummary()),
+          $commit->loadCommitData()->getSummary(),
         );
       }
 

src/applications/diffusion/controller/DiffusionHomeController.php

@@ -19,7 +19,7 @@ final class DiffusionHomeController extends DiffusionController {
               'href' => $shortcut->getHref(),
             ),
             $shortcut->getName()),
-          phutil_escape_html($shortcut->getDescription()),
+          $shortcut->getDescription(),
         );
       }
 
@@ -130,7 +130,7 @@ final class DiffusionHomeController extends DiffusionController {
             'href' => '/diffusion/'.$repository->getCallsign().'/',
           ),
           $repository->getName()),
-        phutil_escape_html($repository->getDetail('description')),
+        $repository->getDetail('description'),
         PhabricatorRepositoryType::getNameForRepositoryType(
           $repository->getVersionControlSystem()),
         $size,

src/applications/diffusion/controller/DiffusionLintController.php

@@ -71,11 +71,10 @@ final class DiffusionLintController extends DiffusionController {
           '<a href="%s">%s</a>',
           $drequest->generateURI(array('action' => 'lint')),
           $drequest->getCallsign()),
-        phutil_escape_html(ArcanistLintSeverity::getStringForSeverity(
+        ArcanistLintSeverity::getStringForSeverity($code['maxSeverity']),
-          $code['maxSeverity'])),
+        $code['code'],
-        phutil_escape_html($code['code']),
+        $code['maxName'],
-        phutil_escape_html($code['maxName']),
+        $code['maxDescription'],
-        phutil_escape_html($code['maxDescription']),
       );
     }
 

src/applications/diffusion/controller/DiffusionLintDetailsController.php

@@ -34,10 +34,9 @@ final class DiffusionLintDetailsController extends DiffusionController {
       $rows[] = array(
         $path,
         $line,
-        phutil_escape_html(ArcanistLintSeverity::getStringForSeverity(
+        ArcanistLintSeverity::getStringForSeverity($message['severity']),
-          $message['severity'])),
+        $message['name'],
-        phutil_escape_html($message['name']),
+        $message['description'],
-        phutil_escape_html($message['description']),
       );
     }
 
@@ -71,7 +70,7 @@ final class DiffusionLintDetailsController extends DiffusionController {
 
     $content[] = id(new AphrontPanelView())
       ->setHeader(
-        ($lint != '' ? phutil_escape_html($lint)." \xC2\xB7 " : '').
+        ($lint != '' ? $lint." \xC2\xB7 " : '').
         pht('%d Lint Message(s)', count($messages)))
       ->setCaption($link)
       ->appendChild($table)

src/applications/diffusion/controller/DiffusionRepositoryController.php

@@ -68,7 +68,7 @@ final class DiffusionRepositoryController extends DiffusionController {
       'View Full Commit History');
 
     $panel = new AphrontPanelView();
-    $panel->setHeader("Recent Commits · {$all}");
+    $panel->setHeader(hsprintf("Recent Commits · %s", $all));
     $panel->appendChild($history_table);
     $panel->setNoBackground();
 
@@ -125,9 +125,7 @@ final class DiffusionRepositoryController extends DiffusionController {
 
     $rows = array();
     foreach ($properties as $key => $value) {
-      $rows[] = array(
+      $rows[] = array($key, $value);
-        phutil_escape_html($key),
-        phutil_escape_html($value));
     }
 
     $table = new AphrontTableView($rows);

src/applications/diffusion/controller/DiffusionSymbolController.php

@@ -81,8 +81,8 @@ final class DiffusionSymbolController extends DiffusionController {
         $project_name = '-';
       }
 
-      $file = phutil_escape_html($symbol->getPath());
+      $file = $symbol->getPath();
-      $line = phutil_escape_html($symbol->getLineNumber());
+      $line = $symbol->getLineNumber();
 
       $repo = $symbol->getRepository();
       if ($repo) {
@@ -101,17 +101,17 @@ final class DiffusionSymbolController extends DiffusionController {
           ),
           $file.':'.$line);
       } else if ($file) {
-        $location = phutil_escape_html($file.':'.$line);
+        $location = $file.':'.$line;
       } else {
         $location = '?';
       }
 
       $rows[] = array(
-        phutil_escape_html($symbol->getSymbolType()),
+        $symbol->getSymbolType(),
-        phutil_escape_html($symbol->getSymbolContext()),
+        $symbol->getSymbolContext(),
-        phutil_escape_html($symbol->getSymbolName()),
+        $symbol->getSymbolName(),
-        phutil_escape_html($symbol->getSymbolLanguage()),
+        $symbol->getSymbolLanguage(),
-        phutil_escape_html($project_name),
+        $project_name,
         $location,
       );
     }

src/applications/diffusion/query/browse/DiffusionBrowseQuery.php

@@ -119,15 +119,14 @@ abstract class DiffusionBrowseQuery {
       $readme_content = $highlighter
         ->getHighlightFuture($readme_content)
         ->resolve();
-      $readme_content = nl2br($readme_content);
+      $readme_content = phutil_escape_html_newlines($readme_content);
-      $readme_content = phutil_safe_html($readme_content);
 
       require_celerity_resource('syntax-highlighting-css');
       $class = 'remarkup-code';
     } else {
       // Markup extensionless files as remarkup so we get links and such.
       $engine = PhabricatorMarkupEngine::newDiffusionMarkupEngine();
-      $readme_content = phutil_safe_html($engine->markupText($readme_content));
+      $readme_content = $engine->markupText($readme_content);
 
       $class = 'phabricator-remarkup';
     }

src/applications/diffusion/view/DiffusionBrowseTableView.php

@@ -55,7 +55,7 @@ final class DiffusionBrowseTableView extends DiffusionView {
           $committer = self::renderName($committer);
         }
         if ($author != $committer) {
-          $author .= '/'.$committer;
+          $author = hsprintf('%s/%s', $author, $committer);
         }
       }
 
@@ -132,24 +132,17 @@ final class DiffusionBrowseTableView extends DiffusionView {
         $browse_text = $path->getPath().'/';
         $dir_slash = '/';
 
-        $browse_link = '<strong>'.$this->linkBrowse(
+        $browse_link = phutil_tag('strong', array(), $this->linkBrowse(
           $base_path.$path->getPath().$dir_slash,
           array(
-            'text' => $this->renderPathIcon(
+            'text' => $this->renderPathIcon('dir', $browse_text),
-              'dir',
+          )));
-              $browse_text),
-          )).'</strong>';
       } else if ($file_type == DifferentialChangeType::FILE_SUBMODULE) {
         $browse_text = $path->getPath().'/';
-        $browse_link =
+        $browse_link = phutil_tag('strong', array(), $this->linkExternal(
-          '<strong>'.
-            $this->linkExternal(
           $path->getHash(),
           $path->getExternalURI(),
-              $this->renderPathIcon(
+          $this->renderPathIcon('ext', $browse_text)));
-                'ext',
-                $browse_text)).
-          '</strong>';
       } else {
         if ($file_type == DifferentialChangeType::FILE_SYMLINK) {
           $type = 'link';
@@ -190,7 +183,7 @@ final class DiffusionBrowseTableView extends DiffusionView {
 
         $need_pull[$uri] = $dict;
         foreach ($dict as $k => $uniq) {
-          $dict[$k] = '<span id="'.$uniq.'"></span>';
+          $dict[$k] = phutil_tag('span', array('id' => $uniq), '');
         }
       }
 

src/applications/diffusion/view/DiffusionCommentListView.php

@@ -87,10 +87,10 @@ final class DiffusionCommentListView extends AphrontView {
       ++$num;
     }
 
-    return
+    return phutil_tag(
-      '<div class="diffusion-comment-list">'.
+      'div',
-        $this->renderSingleView($comments).
+      array('class' => 'diffusion-comment-list'),
-      '</div>';
+      $comments);
   }
 
 }

src/applications/diffusion/view/DiffusionCommentView.php

@@ -114,17 +114,19 @@ final class DiffusionCommentView extends AphrontView {
     $actions = array();
     if ($action == PhabricatorAuditActionConstants::ADD_CCS) {
       $rendered_ccs = $this->renderHandleList($added_ccs);
-      $actions[] = "{$author_link} added CCs: {$rendered_ccs}.";
+      $actions[] = hsprintf("%s added CCs: %s.", $author_link, $rendered_ccs);
     } else if ($action == PhabricatorAuditActionConstants::ADD_AUDITORS) {
       $rendered_auditors = $this->renderHandleList($added_auditors);
-      $actions[] = "{$author_link} added auditors: ".
+      $actions[] = hsprintf(
-        "{$rendered_auditors}.";
+        "%s added auditors: %s.",
+        $author_link,
+        $rendered_auditors);
     } else {
-      $actions[] = "{$author_link} ".phutil_escape_html($verb)." this commit.";
+      $actions[] = hsprintf("%s %s this commit.", $author_link, $verb);
     }
 
     foreach ($actions as $key => $action) {
-      $actions[$key] = '<div>'.$action.'</div>';
+      $actions[$key] = phutil_tag('div', array(), $action);
     }
 
     return $actions;
@@ -137,13 +139,12 @@ final class DiffusionCommentView extends AphrontView {
     if (!strlen($comment->getContent()) && empty($this->inlineComments)) {
       return null;
     } else {
-      return
+      return hsprintf(
-        '<div class="phabricator-remarkup">'.
+        '<div class="phabricator-remarkup">%s%s</div>',
         $engine->getOutput(
           $comment,
-            PhabricatorAuditComment::MARKUP_FIELD_BODY).
+          PhabricatorAuditComment::MARKUP_FIELD_BODY),
-          $this->renderSingleView($this->renderInlines()).
+        $this->renderSingleView($this->renderInlines()));
-        '</div>';
     }
   }
 
@@ -186,7 +187,7 @@ final class DiffusionCommentView extends AphrontView {
     foreach ($phids as $phid) {
       $result[] = $this->handles[$phid]->renderLink();
     }
-    return implode(', ', $result);
+    return phutil_implode_html(', ', $result);
   }
 
   private function renderClasses() {

src/applications/diffusion/view/DiffusionCommitChangeTableView.php

@@ -51,7 +51,7 @@ final class DiffusionCommitChangeTableView extends DiffusionView {
           ),
           $path);
       } else {
-        $path_column = phutil_escape_html($path);
+        $path_column = $path;
       }
 
       $rows[] = array(

src/applications/diffusion/view/DiffusionHistoryTableView.php

@@ -107,7 +107,7 @@ final class DiffusionHistoryTableView extends DiffusionView {
         } else {
           $committer = self::renderName($committer);
         }
-        $author .= '/'.$committer;
+        $author = hsprintf('%s/%s', $author, $committer);
       }
 
       $commit = $history->getCommit();
@@ -118,7 +118,7 @@ final class DiffusionHistoryTableView extends DiffusionView {
           $path = null,
           $history->getCommitIdentifier());
       } else {
-        $change = "<em>Importing\xE2\x80\xA6</em>";
+        $change = phutil_tag('em', array(), "Importing\xE2\x80\xA6");
       }
 
       $rows[] = array(

src/applications/diffusion/view/DiffusionTagListView.php

@@ -79,7 +79,6 @@ final class DiffusionTagListView extends DiffusionView {
           $description = $tag->getDescription();
         }
       }
-      $description = phutil_escape_html($description);
 
       $rows[] = array(
         $tag_link,

src/applications/diffusion/view/DiffusionView.php

@@ -156,7 +156,7 @@ abstract class DiffusionView extends AphrontView {
         ),
         $email->getDisplayName());
     }
-    return phutil_escape_html($name);
+    return hsprintf('%s', $name);
   }
 
 }

src/applications/diviner/controller/DivinerListController.php

@@ -50,10 +50,7 @@ final class DivinerListController extends PhabricatorController {
         $flavor);
     }
 
-    $out =
+    $out = phutil_tag('div', array('class' => 'aphront-directory-list'), $out);
-      '<div class="aphront-directory-list">'.
-        implode("\n", $out).
-      '</div>';
 
     return $this->buildApplicationPage(
       $out,

src/applications/drydock/controller/DrydockController.php

@@ -44,7 +44,7 @@ abstract class DrydockController extends PhabricatorController {
             'href' => $lease_uri,
           ),
           $log->getLeaseID()),
-        phutil_escape_html($log->getMessage()),
+        $log->getMessage(),
         phabricator_date($log->getEpoch(), $user),
       );
     }

src/applications/drydock/controller/DrydockLeaseReleaseController.php

@@ -24,8 +24,8 @@ final class DrydockLeaseReleaseController extends DrydockController {
       $dialog = id(new AphrontDialogView())
         ->setUser($user)
         ->setTitle(pht('Lease Not Active'))
-        ->appendChild(
+        ->appendChild(phutil_tag('p', array(), pht(
-          '<p>'.pht('You can only release "active" leases.').'</p>')
+          'You can only release "active" leases.')))
         ->addCancelButton($lease_uri);
 
       return id(new AphrontDialogResponse())->setDialog($dialog);
@@ -35,11 +35,10 @@ final class DrydockLeaseReleaseController extends DrydockController {
       $dialog = id(new AphrontDialogView())
         ->setUser($user)
         ->setTitle(pht('Really release lease?'))
-        ->appendChild(
+        ->appendChild(phutil_tag('p', array(), pht(
-          '<p>'.pht(
           'Releasing a lease may cause trouble for the lease holder and '.
           'trigger cleanup of the underlying resource. It can not be '.
-            'undone. Continue?').'</p>')
+          'undone. Continue?')))
         ->addSubmitButton(pht('Release Lease'))
         ->addCancelButton($lease_uri);
 

src/applications/drydock/controller/DrydockResourceCloseController.php

@@ -24,8 +24,8 @@ final class DrydockResourceCloseController extends DrydockController {
       $dialog = id(new AphrontDialogView())
         ->setUser($user)
         ->setTitle(pht('Resource Not Open'))
-        ->appendChild(
+        ->appendChild(phutil_tag('p', array(), pht(
-          '<p>'.pht('You can only close "open" resources.').'</p>')
+          'You can only close "open" resources.')))
         ->addCancelButton($resource_uri);
 
       return id(new AphrontDialogResponse())->setDialog($dialog);
@@ -35,10 +35,9 @@ final class DrydockResourceCloseController extends DrydockController {
       $dialog = id(new AphrontDialogView())
         ->setUser($user)
         ->setTitle(pht('Really close resource?'))
-        ->appendChild(
+        ->appendChild(phutil_tag('p', array(), pht(
-          '<p>'.pht(
           'Closing a resource releases all leases and destroys the '.
-            'resource. It can not be undone. Continue?').'</p>')
+          'resource. It can not be undone. Continue?')))
         ->addSubmitButton(pht('Close Resource'))
         ->addCancelButton($resource_uri);
 

src/applications/fact/controller/PhabricatorFactHomeController.php

@@ -32,10 +32,7 @@ final class PhabricatorFactHomeController extends PhabricatorFactController {
       $name = $spec->getName();
       $value = $spec->formatValueForDisplay($user, $fact->getValueX());
 
-      $rows[] = array(
+      $rows[] = array($name, $value);
-        phutil_escape_html($name),
-        phutil_escape_html($value),
-      );
     }
 
     $table = new AphrontTableView($rows);

src/applications/feed/builder/PhabricatorFeedBuilder.php

@@ -40,8 +40,8 @@ final class PhabricatorFeedBuilder {
 
       if ($date !== $last_date) {
         if ($last_date !== null) {
-          $null_view->appendChild(
+          $null_view->appendChild(hsprintf(
-            '<div class="phabricator-feed-story-date-separator"></div>');
+            '<div class="phabricator-feed-story-date-separator"></div>'));
         }
         $last_date = $date;
         $null_view->appendChild(
@@ -59,10 +59,9 @@ final class PhabricatorFeedBuilder {
       $null_view->appendChild($view);
     }
 
-    return id(new AphrontNullView())->appendChild(
+    return id(new AphrontNullView())->appendChild(hsprintf(
-      '<div class="phabricator-feed-frame">'.
+      '<div class="phabricator-feed-frame">%s</div>',
-        $null_view->render().
+      $null_view->render()));
-      '</div>');
   }
 
 }

src/applications/feed/story/PhabricatorFeedStory.php

@@ -224,7 +224,7 @@ abstract class PhabricatorFeedStory implements PhabricatorPolicyInterface {
     foreach ($phids as $phid) {
       $list[] = $this->linkTo($phid);
     }
-    return implode(', ', $list);
+    return phutil_implode_html(', ', $list);
   }
 
   final protected function linkTo($phid) {