[ruby-core:47225] Re: [ruby-trunk - Bug #6861] ERB::Util.escape_html is not escaping single quotes

On Tue, Aug 14, 2012 at 10:10:23AM +0900, shugo (Shugo Maeda) wrote:
> Issue #6861 has been updated by shugo (Shugo Maeda).
> Aaron Patterson wrote:
> >  > I and SEKI have discussed it, and have agreed to use cgi/util.
> >  > CGI.escapeHTML has a problem that is uses ' instead of ', but
> >  > xibbar will fix it later.
> >  
> >  Shouldn't CGI use ERB?  It seems like ERB's use is for creating HTML,
> >  where CGI is in charge of providing the common gateway interface.
> 
> I admit that the name CGI is wrong.  However, despite its name, CGI provides various features for Web applications.  For example, cgi/html.rb provides features to generate HTML, and cgi/util.rb provides utility methods such as HTML.

OK!  Then this change seems good.

> >  ERB concerns itself with templating and should have knowledge of
> >  template formats / escaping.  It seems CGI would not.
> 
> HTML templating is the most common use case of ERB, but ERB is originally independent from HTML.  For example, it can be used to embed Ruby code into TeX files.
> Furthermore, ERB is provided as a single large file, and it's not a good idea to make CGI to depend the whole ERB.

Makes sense.  Thanks! :-D

-- 
Aaron Patterson
http://tenderlovemaking.com/