A critique of cgi.escape

[Duncan Booth]

Jon Ribbens <jon+usenet at unequivocal.co.uk> wrote:

> In article <ef8oqr$9pt$1 at news.albasani.net>, Georg Brandl wrote:
>>> I'm sorry, that's not good enough. How, precisely, would it break
>>> "existing code"? Can you come up with an example, or even an
>>> explanation of how it *could* break existing code?
>> 
>> Is that so hard to see? If cgi.escape replaced "'" with an entity
>> reference, code that expects it not to do so would break.
> 
> Sorry, that's still not good enough. Why would any code expect such a
> thing?
> 

It's easy enough to come up with examples which might. For example, I
have doctests which evaluate tal expressions. I don't think I currently
have any which depend on quotes, but I can easily create one (I just 
did, and it passes): 

  >>> print T('''<tal:x tal:content="python:'It\\'s a \\x22tal\\x22 string'" />''')
  It's a "tal" string
  >>> print T('''<x tal:attributes="title python:'It\\'s a \\x22tal\\x22 string'" />''')
  <x title="It's a "tal" string" />

More likely I might output a field value and just happen to have used a quote
in it.

FWIW, in zope tal, the value of tal:content is escaped using the equivalent of 
cgi.escape(s, False), and attribute values are escaped using 
cgi.escape(s, True).

The function T I use is defined as:

def T(template, **kw):
    """Create and render a page template."""
    pt = PageTemplate()
    pt.pt_edit(template, 'text/html')
    return pt.pt_render(extra_context=kw).strip('\n')