htmlfill inadvertently escaping input field values

Philip Jenvey <[email protected]> Sat, 19 May 2007 13:21:02 -0700

Newsgroups	gmane.comp.python.formencode
Message-ID	<[email protected]>

This was reported on the Pylons trac: http://pylonshq.com/project/ 
pylonshq/ticket/212

The problem is htmlfill htmlescapes all input field values it comes  
across. E.g.:

$ cat formencode_test.py
from formencode import htmlfill

html = """
<html>
   <body>
     <form action="/submit" method="POST">
       <div id="hello">Hello &rarr;</div>
       <input type="submit" value="Submit &rarr;" />
     </form>
   </body>
</html>"""

rendered = htmlfill.render(html, {}, {})
assert "Hello &rarr;" in rendered, rendered
assert '"Submit &rarr;"' in rendered, rendered

$ python formencode_test.py
Traceback (most recent call last):
   File "formencode_test.py", line 15, in ?
     assert '"Submit &rarr;"' in rendered, rendered
AssertionError:
<html>
   <body>
     <form action="/submit" method="POST">
       <div id="hello">Hello &rarr;</div>
       <input type="submit" value="Submit &amp;rarr;" />
     </form>
   </body>


It should really only htmlescape field values pulled out of the  
defaults dictionary (not mess with other HTML).

--
Philip Jenvey



-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/