From e0a45d926b9f624f630113e11ac5f9d7b8bffe47 Mon Sep 17 00:00:00 2001
From: Kirill Efimov <kirill@snyk.io>
Date: Thu, 28 Nov 2019 18:31:02 +0200
Subject: [PATCH] Add security recommendation to README.md (fixes #353)

---
 README.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index a596ace..3a0ec69 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ A quick example:
 
 ```php
 <?php
-$m = new Mustache_Engine;
+$m = new Mustache_Engine(array('entity_flags' => ENT_QUOTES));
 echo $m->render('Hello {{planet}}', array('planet' => 'World!')); // "Hello World!"
 ```
 
@@ -53,11 +53,12 @@ And render it:
 
 ```php
 <?php
-$m = new Mustache_Engine;
+$m = new Mustache_Engine(array('entity_flags' => ENT_QUOTES));
 $chris = new Chris;
 echo $m->render($template, $chris);
 ```
 
+*Note:* we recommend using `ENT_QUOTES` as a default of [entity_flags](https://github.com/bobthecow/mustache.php/wiki#entity_flags) to decrease the chance of Cross-site scripting vulnerability.
 
 And That's Not All!
 -------------------