3 ms·
Go's HTML templates implement similar escaping based on context: (http://golang.org/pkg/html/template/ http://golang.org/pkg/html/template/) "This package unde
by cdoxsey 14y ago
Go's HTML templates implement similar escaping based on context: (http://golang.org/pkg/html/template/ http://golang.org/pkg/html/template/)
"This package understands HTML, CSS, JavaScript, and URIs. It adds sanitizing functions to each simple action pipeline, so given the excerpt
<a href="/search?q={{.}}">{{.}}</a>
At parse time each {{.}} is overwritten to add escaping functions as necessary. In this case it becomes
<a href="/search?q={{. | urlquery}}">{{. | html}}</a>"
- ufo 14y agoDo you know what approach the go template package actually uses to do the escaping? The original article is pretty comprehensive as to what alternatives people tend to use and lists pros and cons for most of them. However, when I searched to source code I found a link[1] back to the original article so now I'm just more confused! [1] http://golang.org/src/pkg/html/template/doc.go#L169 http://golang.org/src/pkg/html/template/doc.go#L169
- carbocation 14y agoHere is escape.go from html/template : https://code.google.com/p/go/source/browse/src/pkg/html/template/escape.go?name=release-branch.go1 https://code.google.com/p/go/source/browse/src/pkg/html/temp...
- ufo 14y agoWait a minute. If its just adding escaping functions to the templates, who is actually running the templates?