Introduce a : placeholder which works like ! for now

Thanks for opening this as a separate issue.

This is as minimal as I would want.

I'm open to us choosing a different prefix per #2565895-50: Add a new :placeholder to SafeMarkup::format() for URLs that handles bad protocols.

+++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php
@@ -193,6 +193,12 @@ public static function checkPlain($text) {
+   *     behavior is the same as !variable, so only use it for URLs that
+   *     have already been filtered for dangerous protocols or are otherwise
+   *     known to not contain them (e.g., if generated from a route). See

Just a very small nit but have could be after that :)

In #2565895: Add a new :placeholder to SafeMarkup::format() for URLs that handles bad protocols some concerns were raised about calling it ":", any thoughts on using another character? I think someone mentioned "~" earlier?

Keeping up with reviews (#4) while we await discussion on #5.

Don't know if it makes any difference but at least in my keyboard making ~ is a lot harder than :

For me ":" is the next character which appears often in URLs.

I don't know what URLs you work with, but for me, the character I see most often is "/" :) Maybe that would help convey "this is a URL", but it would not convey "and that's important because of xss injection via untrusted protocols". In other words, the sanitization does (will do) nothing special related to "/" characters within the value, but maybe that's ok, since that's an implementation detail anyway.

Other suggestions from me are # and +, both simply because they should exist in many of the keyboards and at least for me both of them are still easier than ~.

Just for completeness, I'd like to ask if ":" is really a bad choice. #2565895-50: Add a new :placeholder to SafeMarkup::format() for URLs that handles bad protocols correctly points out that PDO placeholders always use ":" regardless of whether it's a URL or not, but:

1. Do we expect $database->query() to be very commonly used by module developers? Given that $database->select(), $database->update(), etc. are generally better choices, and using even higher-level APIs like $config, $entity, etc. is an even better choice than coupling directly to a relational database.
2. Even if the answer to above is yes, do $database->query() and t() occupy sufficiently different mental compartments that their placeholder syntax can also be remembered contextually?

I think we agreed on the call to go ahead with #2565895: Add a new :placeholder to SafeMarkup::format() for URLs that handles bad protocols straightaway, so this can probably be closed as duplicate then?

Yep.