smarty|escape

hi,


in some binarycloud core templates output is escaped with the smarty  
modifier {$var|escape}, in most this is not done...

in form/nodes/tpl/hint.tpl
<div id="{$node.xid}_tip" class="HintText">{$hint|escape}</div>

in form/nodes/tpl/checkBoxFormInput
<input id="{$node.xid}" type="checkbox" class="CheckBox"  
name="{$node.id}" tabindex="{counter}" {if $disabled != FALSE}  
disabled="disabled"{/if}{if $readonly != FALSE} readonly="readonly"{/ 
if}{if $checked != FALSE} checked="checked"{/if} value="{$value}" />

In the above example it seems that escaping would be in order. But  
for the first {$hint|escape, 'htmlall'} (htmlentities()) seem even  
more because this has to be rendered by the browser and the output is  
html.

It would suggest that everything as a value between "" in a tag  
should be escaped with {$hint|escape, 'html'} htmlspecialchars(),  
everythging rendered by the browser should be done woth {$hint| 
escape, 'htmlall'} (htmlentities())

It seems to me that all output in for example table should be escaped  
by default...

For the record, its seems logical to me that the application (the  
nodes) shouldn't be responsible for escaping values before feeding  
them to the render engine... But perhaps someone might argument  
differently...

Before I add escapes left and right I would like your opinions on  
this...


Bas
_______________________________________________
dev mailing list
dev-PnctHDZWAvB/Cz2I37pSEPZ4XP/[email protected]
http://lists.binarycloud.com/mailman/listinfo/dev