Re: [PATCH] gitweb: Change to use explicitly function call cgi->escapHTML()

From: Jakub Narebski <jnareb@gmail.com>
Date: Mar 6, 2007, 13:23 UTC
Message-ID: <200703061423.18417.jnareb@gmail.com>
In-Reply-To: <7vzm6qps51.fsf@assigned-by-dhcp.cox.net>

Junio C Hamano wrote:

Show 7 quoted lines

> Speaking of -title, I see "sub git_project_list_body" does this:
> 
>     $cgi->a({ ... -title => $pr->{'descr_long'}}, esc_html($pr->{'descr'}));
>         
> which seems inconsistent with the earlier quoted $fullname
> handling (unless $pr->{'descr_long'} is already quoted and $pr->{'descr'}
> is not, which I find highly unlikely).

CGI::a() subroutine automatically quotes properly _attribute_ values, but it does not (and it should not) quote _contents_ of a tag.

So the above code is correct.

-- 
Jakub Narebski
Poland