Minor tweaks (quixote/doc/PTL.txt)
Andrew Kuchling <akuchlin-fVcApmY9cLvQ3/1i3zOLAti2O/[email protected]> Mon, 06 Jan 2003 15:14:36 -0500
| Newsgroups | gmane.comp.web.quixote.cvs |
|---|---|
| Message-ID | <[email protected]> |
Update of /home/cvs/quixote/doc In directory hewson:/tmp/cvs-serv17299 Modified Files: PTL.txt Log Message: Minor tweaks Index: PTL.txt =================================================================== RCS file: /home/cvs/quixote/doc/PTL.txt,v retrieving revision 1.15 retrieving revision 1.16 diff -u -d -r1.15 -r1.16 --- PTL.txt 6 Jan 2003 20:05:35 -0000 1.15 +++ PTL.txt 6 Jan 2003 20:14:34 -0000 1.16 @@ -111,7 +111,7 @@ HTML templates -------------- -Since PTL is usually used to generate HTML documents, a ``[html]`` +Since PTL is usually used to generate HTML documents, an ``[html]`` template type has been provided to make generating HTML easier. A common error when generating HTML is to grab data from the browser @@ -123,9 +123,9 @@ popping up 10,000 browser windows). Such bugs occur because it's easy to forget to HTML-escape a string, -and forgetting one is enough to open a hole. The PTL solution to this -problem is to handle it for you, automatically escaping strings -when generating HTML output. +and forgetting it in just one location is enough to open a hole. PTL +offers a solution to this problem by optionally escaping strings +automatically when generating HTML output. Here's how this feature works. PTL defines a class called ``htmltext`` that represents a string that's already been HTML-escaped @@ -135,10 +135,11 @@ Both ``htmltext`` and ``htmlescape`` are available from the global namespace in PTL modules. -If a template function is declared ``[html]`` instead of ``[text]`` then -two things happen. First, all literal strings in the function become -instances of ``htmltext`` instead of ``str``. Second, the values of -expressions are passed through ``htmlescape()`` instead of ``str()``. +If a template function is declared ``[html]`` instead of ``[text]`` +then two things happen. First, all literal strings in the function +become instances of ``htmltext`` instead of Python's ``str``. Second, +the values of expressions are passed through ``htmlescape()`` instead +of ``str()``. ``htmltext`` type is like the ``str`` type except that operations combining strings and ``htmltext`` instances will result in the string