Jakub Narebski edc04e90f5 gitweb: Don't escape attributes in CGI.pm HTML methods ...

There is no need to escape HTML tag's attributes in CGI.pm
HTML methods (like CGI::a()), because CGI.pm does attribute
escaping automatically.

  $cgi->a({ ... -attribute => atribute_value }, tag_contents)

is translated to

  <a ... attribute="attribute_value">tag_contents</a>

The rules for escaping attribute values (which are string contents) are
different. For example you have to take care about escaping embedded '"'
and "'" characters; CGI::a() does that for us automatically.

CGI::a() does not HTML escape tag_contents; we would need to write

  <a href="URL">some <b>bold</b> text</a>

for example. So we use esc_html (or esc_path) to escape tag_contents
as needed.

Signed-off-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>

2007-03-06 19:04:07 -08:00

136 KiB

Executable File

Raw Blame History

View Raw