Re: A critique of cgi.escape

In message <slrnehbra1.kpr.jon+usenet@xxxxxxxxxxxxxxxx>, Jon Ribbens wrote:

In article <mailman.499.1159035571.10491.python-list@xxxxxxxxxx>, Fredrik
Lundh wrote:
Lawrence D'Oliveiro wrote:

So I think the default for the second argument to cgi.escape should be
changed to True. Or alternatively, the second argument should be removed
altogether, and quotes should always be escaped.

you're confused: cgi.escape(s) is designed to be used for ordinary text,
cgi.escape(s, True) is designed for attributes. if you use the code the
way it's intended to be used, it works perfectly fine.

He's not confused, he's correct; the author of cgi.escape is the
confused one.

Thanks for backing me up. :)

One thing that is flat-out wrong, by the way, is that cgi.escape()
does not encode the apostrophe (') character. This is essentially
identical to the quote character in HTML, so any code which escaping
one should always be escaping the other.

I must confess I did a double-take on this. But I rechecked the HTML spec
(HTML 4.0, section 3.2.2, "Attributes"), and you're right--single quotes
ARE allowed as an alternative to double quotes. It's just I've never used
them as quotes. :)
.

Relevant Pages

  • A critique of cgi.escape
    ... The ones that need escaping are '<', ... cgi.escape only escapes the quote character if you pass a second ... Nevertheless, even in that situation, escaped quotes are acceptable. ...
    (comp.lang.python)
  • Re: [PHP] Double checking - I should turn off "magic quotes"
    ... quotes on my server? ... to the no magic quotes standard, then I should be safe, right? ... my testing environment and my server, ... If you just balatantly apply the databases escaping policy some ...
    (php.general)
  • Re: exec $env(COMSPEC) /c file_with_(parenthesis)
    ... the issue I'm having is 1/2 due to Windows and 1/2 due to Tcl. ... is to see if the first character is a quote character and if so, ... quotes that escapes the parenthesis. ... Okay, slip an echo in there to see if everthing is working properly, ...
    (comp.lang.tcl)
  • Re: How do I escape parentheses in a mysql query?
    ... You should use single quotes for strings in SQL, ... MySQL can, in some cases, accept either, but you should stick with the right ... You use escaping on all the variable values you're using in the SQL. ...
    (comp.lang.php)
  • Re: Openning Files Names with Embedded Spaces
    ... > I am using Active Perl under Windoze 98. ... > embedded spaces. ... I tried escaping the spaces as well, ... Instead, if the problem is the loss of double quotes, single-quote the ...
    (perl.beginners)