A critique of cgi.escape

[Brian Quinlan]

A summary of this pointless argument:

Why cgi.escape should be changed to escape double quote (and maybe
    single quote) characters by default:
o escaping should be very aggressive by default to avoid subtle bugs
o over-escaping is not likely to harm most program significantly
o people who do not read the documentation may be surprised by it's
   behavior

Why cgi.escape should NOT be changed:
o it is current used in lots of code and changing it will almost
   certainly break some of it, test suites at minimum e.g.
   assert my_template_system("<p>{foo}</p>", foo='"') == '<p>"</p>'
o escaping attribute values is less common than escaping element
   text so people should not be punished with:
     - harder to read output
     - (slightly) increased file size
     - (slightly) decreased performance
o cgi.escape is not meant for serious web application development, so
   either roll your own (trivial) function to do escaping how you want
   it or use the one provided by your framework (if it is not automatic)
o the documentation describes the current behavior precisely and
   suggests solutions that provide more aggressive escaping, so arguing
   about surprising behavior is not reasonable
o it doesn't even make sense for an escape function to exist in the cgi
   module, so it should only be used by old applications for
   compatibility reasons


Cheers,
Brian