A critique of cgi.escape

[Lawrence D'Oliveiro]

In message <mailman.518.1159087749.10491.python-list at python.org>, Fredrik
Lundh wrote:

> Jon Ribbens wrote:
> 
>> Making cgi.escape always escape the '"' character would not break
>> anything, and would probably fix a few bugs in existing code. Yes,
>> those bugs are not cgi.escape's fault, but that's no reason not to
>> be helpful. It's a minor improvement with no downside.
> 
> the "improvement with no downside" would bloat down the output for
> everyone who's using the function in the intended way, and will also
> break unit tests.

I don't understand this "bloat down" nonsense. Any tests that would break
are obviously testing the wrong thing.

>  > One thing that is flat-out wrong, by the way, is that cgi.escape()
>  > does not encode the apostrophe (') character.
> 
> it's intentional, of course: you're supposed to use " if you're using
> cgi.escape(s, True) to escape attributes.

Attributes can be quoted with either single or double quotes. That's what
the HTML spec says. cgi.escape doesn't correctly allow for that. Ergo,
cgi.escape is broken. QED.

> btw, you're both missing that cgi.escape isn't good enough for general
> use anyway, since it doesn't deal with encodings at all.

Why does it need to?