From: Andreas Schwarz <usenet@...>
Date: 2004-07-25T22:21:54+09:00
Subject: Re: [ANN] Rails 0.5.0: The end of vaporware!

David Heinemeier Hansson wrote:
>>>> The 10 minute video is really impressive. But after browsing 
>>>> through  the documentation I haven't found an answer to one 
>>>> question: what  does happen with XML special chars like <> when you 
>>>> write <%=  @post.text %>?
>>>
>>> I'm not sure I understand the question, but everything within a <% 
>>> %>  block is interpreted as regular Ruby code through ERb
>>
>>
>> Sorry that it wasn't clear, I wanted to know what happened when  
>> @post.text contains characters like ">" or "&". (How) are they  
>> converted to entities?
> 
> 
> Ahh. Rails offers no built-in method for that, but perhaps it should in  
> the TextHelper[1]. You can, however, just use CGI.escapeHTML[2] like  this:
> 
> <%= CGI.escapeHTML(@post.text) %>

I see. This is always what I don't like about Eruby; with Kwartz (and 
most other templating systems) every variable I include with 
#{variable}# is escaped automatically, and it is possible to disable 
escaping by writing #{ X(variable) }#. As 99% of the variables usually 
are not meant to include HTML code anyway, this makes templates look 
clearer and is less error-prone.

Maybe it would make sense to extend Eruby/Erb/whatever with another tag 
that wraps the content in CGI.escapeHTML? For example
{%= @post.text %}
instead of
<%= CGI.escapeHTML( @post.text ) %>
?