` | | `htmldoublequote` | Double-quoted HTML attributes | `

` | | `htmlunquote` | Unquoted HTML attributes | Rarely needed; prefer quoted attributes | | `jshtml` | JavaScript strings in HTML | `` | | `jsattribute` | JS in HTML event attributes | `onclick="..."` | | `jsonvalue` | JSON values | JSON data output | | `uricomponent` | URL query parameters | Query string values | | `uristrict` | Full URI encoding | Path segments | | `xmlcontent` | XML body content | XML/RSS feeds | | `off` | No encoding | Trusted content ONLY -- avoid in production | Always specify encoding. Choose based on output context. Never use raw `${variable}` for user-controlled data without encoding. ### Expression Syntax **Pipeline Dictionary (pdict):** - `${pdict.variableName}` -- access controller-passed data (SFRA: from `res.render()`) - In SFRA, `pdict` contains only what the controller explicitly passed - Legacy SiteGenesis globals (CurrentSession, CurrentRequest, etc.) are NOT available in SFRA controllers **Object Navigation:** - `${pdict.product.name}` -- dot notation for nested properties - `${pdict.basket.totalGrossPrice.value}` -- deep property access - Null-safe: always check for null/undefined before accessing nested properties **Operators:** Arithmetic (`+`, `-`, `*`, `/`, `%`), comparison (`==`, `!=`, `<`, `>`), logical (`&&`, `||`, `!`), ternary (`${cond ? a : b}`). ### `` Status Object | Property | Type | Description | |----------|------|-------------| | `first` | Boolean | True on first iteration | | `last` | Boolean | True on last iteration | | `count` | Number | Current iteration (1-based) | | `index` | Number | Current iteration (0-based) | Access via the `status` attribute: ``, then use `${loopstate.first}`, `${loopstate.index}`, etc. ### `` Scope Rules | Scope | Lifetime | Use Case | |-------|----------|----------| | `page` | Current template render | Temporary computation within a template | | `request` | Current HTTP request | Share data across included templates | | `session` | Current user session | Persist across requests (use sparingly) | Default scope is `session` -- always specify scope explicitly to avoid unintended session pollution. ### Localization (Resource Bundles) ```isml ${Resource.msg('key', 'bundleName', 'Default')} ${Resource.msgf('key', 'bundle', 'Default {0}', param)} ``` Common bundles: `forms`, `common`, `error`, `product`. Always provide meaningful default values. Resource bundles are `.properties` files in `templates/resources/`. ### Decorator Pattern (Template Inheritance) Decorators wrap child content via `` and ``: ```isml

Page Content

``` The decorator template defines shared layout (header, footer, ``) and uses `` to mark where child content is inserted. Nested decorators are supported. ### Common Patterns ```isml ``` ```isml ``` ### URL Generation Helpers | Method | Purpose | |--------|---------| | `URLUtils.url()` | Generate absolute URL for controller action | | `URLUtils.https()` | Force HTTPS URL | | `URLUtils.staticURL()` | URL to static asset in cartridge | | `URLUtils.absURL()` | Absolute URL with full domain | | `URLUtils.home()` | Homepage URL | | `URLUtils.continueURL()` | Current request URL for form returns | ### Content Slots Configured in Business Manager. Slots support HTML, products, categories, or content assets. Use descriptive IDs (`home-banner-top`, `category-promo-sidebar`) and set appropriate context (global, category, folder). Slot rendering can be cached separately from template caching. ### Platform Warnings - `` executes on the server and can access the full SFCC API -- keep logic minimal and move heavy processing to controllers or scripts. - `` persists across requests -- avoid session bloat by defaulting to `page` scope. - SFRA templates do NOT support SiteGenesis pipeline dictionary globals; only data from `res.render()` is available. - Template-level `` is separate from CDN caching; both must be configured correctly. ## Best Practices ### Security - Always encode output with the correct mode for context. - Never use `encoding="off"` unless input is fully trusted. - Use CSRF tokens on all state-changing forms. - Validate user input in controllers before passing to templates. ### Performance - Minimize `` blocks -- move logic to controllers or scripts. - Use `` to compute expensive values once and reuse. - Avoid deeply nested loops and conditionals. - Use `` for templates that do not change per request. ### Maintainability - Use decorators for consistent page layout across templates. - Extract reusable components into separate templates with ``. - Externalize all user-facing strings to resource bundles for i18n. - Follow naming convention: lowercase-hyphenated template names. ### Template Organization | Directory | Contents | |-----------|----------| | `common/layout/` | Decorators (page, checkout, account) | | `components/` | Shared partials (header, footer, navigation) | | `product/` | Product display templates | | `search/` | Search results templates | | `account/` | Customer account templates | | `cart/` | Cart and mini-cart templates | | `checkout/` | Checkout flow templates | --- Fetch the ISML tag reference, encoding mode documentation, and resource bundle guide for exact tag attributes, encoding behaviors, and localization APIs before implementing.