[gr8man]

Description
Removes inappropriate esc(strip_tags()) input transformations from RouteCollection default setters as well as resource() and presenter() controller options so that internal PHP identifiers are preserved without HTML entity conversion or tag stripping.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[michalsn]

I agree with the direction: HTML escaping does not belong on routing identifiers, especially since the Config\Routing constructor path already stores these values unescaped.

However, the PR currently demonstrates a cleanup rather than a patch-level bug. For valid UTF-8 PHP identifiers, the old code leaves permitted characters unchanged. Values such as Foo&Bar are not valid declared identifiers, and the tests only verify storage rather than a failed dispatch. Removing strip_tags() also makes the change broader than preventing entity encoding.

Please:

• describe this as removing inappropriate input transformation and move it from Bugs Fixed to Changes;
• update resource() and presenter() similarly, or explain why they are excluded. The $from handling in create() is a separate concern and should remain outside this PR.

Without a reproducible dispatch failure, I would target the 4.8 branch.

[michalsn]

Please add a test similar to this:

#[DataProvider('provideGeneratedRouteMethods')]
public function testGeneratedRouteDoesNotTransformCustomController(string $method): void
{
    service('request')->setMethod(Method::GET);
    $routes = $this->getCollector();

    $routes->{$method}('photos', [
        'controller' => 'gallery&<b>archive</b>',
    ]);

    $this->assertSame(
        '\Gallery&<b>archive</b>::index',
        $routes->getRoutes()['photos'],
    );
}

public static function provideGeneratedRouteMethods(): iterable
{
    yield 'resource' => ['resource'];
    yield 'presenter' => ['presenter'];
}

To be safe, i would also want to add a section into https://github.com/codeigniter4/CodeIgniter4/blob/4.8/user_guide_src/source/installation/upgrade_480.rst - at the end of the "Breaking Changes", something like:

RouteCollection Identifier Transformation
=========================================

``RouteCollection`` no longer applies ``esc(strip_tags())`` to namespace, controller, and method values, including custom controllers passed to ``resource()`` and ``presenter()``.

Applications relying on HTML tags being stripped or special characters being HTML-encoded must preprocess these values before passing them to the router. Values originating from untrusted sources should be restricted to an explicit allowlist of permitted handlers.