5 ms·
I didn’t see anything about escaping values going into template literals. Did I miss it? That seems important for anything involving user input. Edit: Escapin
by schemescape 4y ago
I didn’t see anything about escaping values going into template literals. Did I miss it?
That seems important for anything involving user input.
Edit: Escaping rules also differ on context (HTML, attribute, URIs, script tags, etc.), so it’s not trivial.
- jpschroeder 4y agoThis is handled by the DOM automatically in arrow since it uses things like “el.setAttribute” and “el.innerText”
- schemescape 4y agoThe examples in the docs show HTML in string format. Does it parse the string to determine the context? > t`<button @click="${() => data.clicks++}">Fired ${() => data.clicks} arrows</button>` If so, that is impressive, and something I'd love to use! Edit: I'm asking because I attempted to use template literals for HTML templates and escaping values is the trickiest part. I settled for requiring the caller to tell me what kind of escaping to use (with the default being very conservative).
- schemescape 4y agoIn the "Events" section of the docs, there's a text box you can type into and the contents get inserted into an "em" element below the text box. If I type HTML into that box, it adds additional HTML elements to the page, so that seems like escaping isn't working. Is that a bug or am I just not understanding what you're saying?