Proposal: <#p expression> for printing values that deliberately store markup
Daniel Dekany <[email protected]> Sun, 24 Feb 2013 11:49:04 +0100
| Newsgroups | gmane.comp.web.freemarker.devel |
|---|---|
| Message-ID | <[email protected]> |
I want to able to tell this simple rule of thumb to users:
- Always put the template into <#escape x as x?html>, or when it
becomes available, just turn on global escaping and forget about it.
- Print values that aren't meant to contain HTML markup with
`${expression}`. These will be automatically escaped.
- Print values that meant to store HTML markup with
`<#p expression>`. These will not be automatically escaped, ever.
In general, what you print with <@...> or <#...>-s (i.e., with
macros or directives) is never escaped. They meant to generate
markup, and that's why they look like HTML tags.
You may wonder why not `${expression?noescape}` or something like that.
For two reasons:
- It violates the rule of thumb shown above. It's something that's not
escaped, meant to generate markup, yet doesn't look like <...>. #p
is true to the above idea.
BTW, there's this confusion in many heads about what's the
difference between a #macro (or a directive) and a #function, and
why you can't call macros inside expression, and so on. The reason
of the distinction is basically the above rule of thumb. Only this
rule wasn't communicated or even executed clearly so far.
- What exactly would be the result of `expression?noescape`? If it's
just an FTL string, how would ${...} know that it must not be
escaped? Or what's the result of `foo + bar?noescape`? In a new
language I probably would have plain-string VS markup-string type,
but adding it to a 10+ years old language would probably be a too
brutal change.
You may also wonder what's the problem with:
<#noescape>${expression}</#noescape>
Well, it's far too ugly for a basic task like this. Other than it's
annoying to type and read back, if many interpolations would print
values that are already markup in a certain template, the author will
possibly feel tempted to remove #escape and use ${exprssion?html} on
the places where the expression value needs to be escaped. Then in
some templates you have to write ?html, in some you must not write
that or you do double-escaping... that's messy and dangerous and
invalidates the rule of thumb shown earlier.
Comments/ideas?
--
Best regards,
Daniel Dekany
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_feb