Review this generated HTML renderer before it receives customer-controlled orders.
Render only paid orders as an HTML list, preserve the valid ID '0', do not mutate the input or global state, and encode customer-controlled IDs for HTML text.
php
<?php
function renderPaidOrders(array $orders): string
{
global $published;
$html = '<ul>';
foreach ($orders as &$order) {
if (!$order['id']) {
continue;
}
if ($order['state'] = 'paid') {
$published[] = $order['id'];
$html .= '<li>' . $order['id'] . '</li>';
}
}
return $html . '</ul>';
}
$published = [];
echo renderPaidOrders($orders);
generated code is illustrative, not from any one model