diff --git a/core/lib/Drupal/Component/Render/FormattableMarkup.php b/core/lib/Drupal/Component/Render/FormattableMarkup.php index 6db6288d47d5913f3c56d1ff34c7c702318f60e9..c6e5ebcb9ddf5d78b2059be7a766406d29555e13 100644 --- a/core/lib/Drupal/Component/Render/FormattableMarkup.php +++ b/core/lib/Drupal/Component/Render/FormattableMarkup.php @@ -124,10 +124,10 @@ public function jsonSerialize(): string { * Insecure examples. * @code * // The following are using the @ placeholder inside an HTML tag. - * $this->placeholderFormat('<@foo>text</@foo>, ['@foo' => $some_variable]); - * $this->placeholderFormat('<a @foo>link text</a>, ['@foo' => $some_variable]); - * $this->placeholderFormat('<a href="@foo">link text</a>, ['@foo' => $some_variable]); - * $this->placeholderFormat('<a title="@foo">link text</a>, ['@foo' => $some_variable]); + * $this->placeholderFormat('<@foo>text</@foo>', ['@foo' => $some_variable]); + * $this->placeholderFormat('<a @foo>link text</a>', ['@foo' => $some_variable]); + * $this->placeholderFormat('<a href="@foo">link text</a>', ['@foo' => $some_variable]); + * $this->placeholderFormat('<a title="@foo">link text</a>', ['@foo' => $some_variable]); * // Implicitly convert an object to a string, which is not sanitized. * $this->placeholderFormat('Non-sanitized replacement value: @foo', ['@foo' => $safe_string_interface_object]); * @endcode