A critique of cgi.escape

The "escape" function in the "cgi" module escapes characters with special
meanings in HTML. The ones that need escaping are '<', '&' and '"'.
However, cgi.escape only escapes the quote character if you pass a second
argument of True (the default is False):

>>> cgi.escape("the \"quick\" & <brown> fox")
'the "quick" &amp; &lt;brown&gt; fox'
>>> cgi.escape("the \"quick\" & <brown> fox", True)
'the &quot;quick&quot; &amp; &lt;brown&gt; fox'

This seems to me to be dumb. The default option should be the safe one: that
is, escape _all_ the potentially troublesome characters. The only time you
can get away with NOT escaping the quote character is outside of markup,
e.g.

<TEXTAREA>
unescaped "quotes" allowed here
</TEXTAREA>

Nevertheless, even in that situation, escaped quotes are acceptable.

So I think the default for the second argument to cgi.escape should be
changed to True. Or alternatively, the second argument should be removed
altogether, and quotes should always be escaped.

Can changing the default break existing scripts? I don't see how. It might
even fix a few lurking bugs out there.
.

Relevant Pages

  • Re: Question - reading command line parms inside a script.
    ... >> Unless you quote the quotes, ... It strips off the escapes. ... My code in this post is copyright 2004, Chris F.A. Johnson ...
    (comp.unix.questions)
  • Re: A critique of cgi.escape
    ... identical to the quote character in HTML, ... one should always be escaping the other. ... But I rechecked the HTML spec ... ARE allowed as an alternative to double quotes. ...
    (comp.lang.python)
  • Re: [PHP] htmlentities() does not remove escape
    ... entities to change these characters into html entities. ... But the function does not remove the escapes added ... Browser doesn't escape those quotes. ... You're PHP configuration has magic ...
    (php.general)
  • Re: fwrite() escapes single and double quotes?
    ... The following code on a production server always escapes any apostrophes ... or double quotes whenever the text file is edited, resulting in multiple ... with double quotes seems to have no affect on either server. ...
    (comp.lang.php)
  • Re: Whats the last argument?
    ... the quotes + escapes right. ... VML. ...
    (comp.unix.shell)