Re: A critique of cgi.escape

In article <mailman.499.1159035571.10491.python-list@xxxxxxxxxx>, Fredrik Lundh wrote:
Lawrence D'Oliveiro wrote:
So I think the default for the second argument to cgi.escape should be
changed to True. Or alternatively, the second argument should be removed
altogether, and quotes should always be escaped.

you're confused: cgi.escape(s) is designed to be used for ordinary text,
cgi.escape(s, True) is designed for attributes. if you use the code the
way it's intended to be used, it works perfectly fine.

He's not confused, he's correct; the author of cgi.escape is the
confused one. The optional extra parameter is completely unnecessary
and achieves nothing except to make it easier for people to end up
with bugs in their code.

Making cgi.escape always escape the '"' character would not break
anything, and would probably fix a few bugs in existing code. Yes,
those bugs are not cgi.escape's fault, but that's no reason not to
be helpful. It's a minor improvement with no downside.

One thing that is flat-out wrong, by the way, is that cgi.escape()
does not encode the apostrophe (') character. This is essentially
identical to the quote character in HTML, so any code which escaping
one should always be escaping the other.
.

Relevant Pages

  • Re: retrieving info from file
    ... be used and hard to find bugs will result. ... And you don't need to escape '=', it's just a plain old character. ...
    (comp.lang.perl.misc)
  • Re: what can i do if i want to include "<" or ">" in xml document.
    ... Sometimes it becomes necessary to escape the quotes and the apostrophe ... Another character to escape almost always is the ampersand character ...
    (microsoft.public.dotnet.xml)
  • Re: deleting files with odd names
    ... What's the correct escape character for this? ... about double quotes? ...
    (comp.os.linux.misc)
  • Re: Using double quotes in String literal
    ... >to append a set of double quotes ... >So if I have: quotes in String ... Note the \ to escape the character... ...
    (comp.lang.java.help)
  • Re: escaped identifier vs regular names ?
    ... Escaped identifiers are not in a separate namespace from normal ... the terminating whitespace character to be a space character, ... And, yes, many Verilog tools create escaped names of this form. ... escape names, it isn't really handling the entire Verilog language. ...
    (comp.lang.verilog)