Re: htmlfill inadvertently escaping input field values

Philip Jenvey wrote:
> Unescaping > and the like is easy enough, but there could be 
> non-ascii html entities. Since the html form passed to htmlfill is 
> typically a raw string in this case, I think handling those would be 
> tricky.
> 
> Patching htmlfill to avoid escaping values from the html looks like a 
> little work, but overall probably simpler.

Stupid HTMLParser is causing the problem.  It *does* unquote html 
entities it knows about.  So if you include > in your document it 
works.  However, entities that it doesn't know about (like →) don't 
get unquoted, and then later they get requoted.

Stupidly, this happens even though htmlentitydefs contains rarr.  So I 
don't know why HTMLParser handles one and not the other.  Well, looking 
at the source, this is HTMLParser.unescape:


     # Internal -- helper to remove special character quoting
     def unescape(self, s):
         if '&' not in s:
             return s
         s = s.replace("&lt;", "<")
         s = s.replace("&gt;", ">")
         s = s.replace("&apos;", "'")
         s = s.replace("&quot;", '"')
         s = s.replace("&amp;", "&") # Must be last
         return s

Wow, that's dumb.  It wouldn't handle &# character references either. 
Anyway, I put in a proper implementation in the trunk.  The one problem 
is that it could lead to unexpected unicode, as it will actually resolve 
&rarr; to the unicode character \u2192 and include that in the output. 
But actually removing unescaping looks rather hard to me.

-- 
Ian Bicking | [email protected] | http://blog.ianbicking.org
             | Write code, do good | http://topp.openplans.org/careers

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/