From: nobuyoshi nakada <nobuyoshi.nakada@...>
Date: 2005-05-19T20:08:57+09:00
Subject: Re: [ ruby-Bugs-1930 ] CGI::escapeHTML escapes the ampersand in an existing escape command

Hi,

At Thu, 19 May 2005 17:18:54 +0900,
Zev Blut wrote in [ruby-core:05044]:
> > It is exactly expected behavior.
> 
> OK.  It would be nice if that was in the documentation somewhere, so
> that other people do not make the same mistake.

$ ri CGI.escapeHTML | cat
-------------------------------------------------------- CGI::escapeHTML
     CGI::escapeHTML(string)
------------------------------------------------------------------------
     Escape special characters in HTML, namely &\"<>

       CGI::escapeHTML('Usage: foo "bar" <baz>')
          # => "Usage: foo &quot;bar&quot; &lt;baz&gt;"


> > The way to let escapeHTML not to escape a particular ampersand is
> > another story.
> 
> I can see the need for the current behavior and of course I have the
> need for the changed behavior.  Two techniques for providing a
> preserving escape come to my mind.  One would be to add an optional
> boolean argument that when true will keep escape commands, the
> default value is false and thus current usage will not change. Another
> is to add another method that implements the patch provided in the
> report.

Leaving ampersands breaks round-trip by escapeHTML and unescapeHTML.
I think it would be a problem.

-- 
Nobu Nakada