Re: htmlfill inadvertently escaping input field values
Ian Bicking <[email protected]>
| Newsgroups | gmane.comp.python.formencode |
|---|---|
| Message-ID | <[email protected]> |
Philip Jenvey wrote:
> This was reported on the Pylons trac: http://pylonshq.com/project/
> pylonshq/ticket/212
>
> The problem is htmlfill htmlescapes all input field values it comes
> across. E.g.:
>
> $ cat formencode_test.py
> from formencode import htmlfill
>
> html = """
> <html>
> <body>
> <form action="/submit" method="POST">
> <div id="hello">Hello →</div>
> <input type="submit" value="Submit →" />
> </form>
> </body>
> </html>"""
>
> rendered = htmlfill.render(html, {}, {})
> assert "Hello →" in rendered, rendered
> assert '"Submit →"' in rendered, rendered
>
> $ python formencode_test.py
> Traceback (most recent call last):
> File "formencode_test.py", line 15, in ?
> assert '"Submit →"' in rendered, rendered
> AssertionError:
> <html>
> <body>
> <form action="/submit" method="POST">
> <div id="hello">Hello →</div>
> <input type="submit" value="Submit &rarr;" />
> </form>
> </body>
>
>
> It should really only htmlescape field values pulled out of the
> defaults dictionary (not mess with other HTML).
Well, it seems like it's not unescaping them when it reads them; if it
did that would also fix it.
--
Ian Bicking | [email protected] | http://blog.ianbicking.org
| Write code, do good | http://topp.openplans.org/careers
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/