#184
  • Created on
    2010-11-25 09:05
  • Reported by
    jstrachan
  • Status
    New
  • Priority
    Normal (3)
  • Assigned to
    -
  • Milestone
    -
  • Plan Level
    -
  • Permission type
    Public
  • Due Date
    -

Attachments

Related Tickets

Add new subtask or bug

should the markup escaping code auto-detect entity references and avoid escaping them?

if we have some text like "this & that" then by default we escape the & to "this & that" which is a bit silly. I wonder if we should by default auto-detect entity references in the markup/text and not escape them?

see the discussion here: http://groups.google.com/group/scalate/browse_thread/thread/6231fc39c6f769b8
User picture
  on 2010-11-25 09:06 *
By jstrachan
Description changed from if we have some text like "... to if we have some text like "...
User picture
  on 2012-04-17 04:13 *
By nilskp
I think a very clear rule should be that content from variables are escaped, but statically typed content is not. And this has to do with context. If it's statically typed in the HTML form, you can be expected to type it correctly. A variable is typically sourced from something else and cannot have the same expectation.