public
Rubygem
Fork of nex3/haml
Description: HTML Abstraction Markup Language - A Markup Haiku
Homepage: http://haml.hamptoncatlin.com
Clone URL: git://github.com/chriseppstein/haml.git
Document the HTML-escaping functionality.
nex3 (author)
Sun Mar 16 15:40:53 -0700 2008
commit  30138e7a1546438887cdeb23e4efe8bfc945ed55
tree    ffab28f88d86f40d9231799159424ffdccbaa1e4
parent  891f39ce4c602027e541464cb90c3c863d1848a7
...
252
253
254
255
 
256
257
258
...
633
634
635
 
 
 
 
 
 
 
 
 
636
637
638
...
685
686
687
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
688
689
690
...
789
790
791
 
 
 
 
 
 
792
793
794
...
252
253
254
 
255
256
257
258
...
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
...
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
...
832
833
834
835
836
837
838
839
840
841
842
843
0
@@ -252,7 +252,7 @@ $LOAD_PATH << dir unless $LOAD_PATH.include?(dir)
0
 # For example:
0
 #
0
 # %br/
0
-# %meta{'http-equiv' => 'Content-Type', :content => 'text/html'}/
0
+# %meta{'http-euiv' => 'Content-Type', :content => 'text/html'}/
0
 #
0
 # is compiled to:
0
 #
0
@@ -633,6 +633,15 @@ $LOAD_PATH << dir unless $LOAD_PATH.include?(dir)
0
 # yo
0
 # </p>
0
 #
0
+# If the <tt>:escape_html</tt> option is set,
0
+# = will sanitize any HTML-sensitive characters generated by the script.
0
+# For example:
0
+#
0
+# = '<script>alert("I\'m evil!");</script>'
0
+#
0
+# would be compiled to
0
+#
0
+# &lt;script&gt;alert(&quot;I'm evil!&quot;);&lt;/script&gt;
0
 #
0
 # ==== -
0
 #
0
@@ -685,6 +694,40 @@ $LOAD_PATH << dir unless $LOAD_PATH.include?(dir)
0
 # \\ Look at \yon lack of backslash: #{foo}
0
 # </p>
0
 #
0
+# ==== &=
0
+#
0
+# An ampersand followed by an equals character
0
+# evaluates Ruby code just like the single equals,
0
+# but sanitizes any HTML-sensitive characters in the result of the code.
0
+# For example:
0
+#
0
+# &= "I like cheese & crackers"
0
+#
0
+# compiles to
0
+#
0
+# I like cheese &amp; crackers
0
+#
0
+# If the <tt>:escape_html</tt> option is set,
0
+# &= behaves identically to =.
0
+#
0
+# ==== !=
0
+#
0
+# An exclamation mark followed by an equals character
0
+# evaluates Ruby code just like the single equals,
0
+# but never sanitizes the HTML.
0
+#
0
+# By default, the single equals doesn't sanitize HTML either.
0
+# However, if the <tt>:escape_html</tt> option is set, = will sanitize the HTML, but != still won't.
0
+# For example, if <tt>:escape_html</tt> is set:
0
+#
0
+# = "I feel <strong>!"
0
+# != "I feel <strong>!"
0
+#
0
+# compiles to
0
+#
0
+# I feel &lt;strong&gt;!
0
+# I feel <strong>!
0
+#
0
 # ===== Blocks
0
 #
0
 # Ruby blocks, like XHTML tags, don't need to be explicitly closed in Haml.
0
@@ -789,6 +832,12 @@ $LOAD_PATH << dir unless $LOAD_PATH.include?(dir)
0
 # identical to :xhtml except there are no self-closing tags,
0
 # XML prolog is ignored and correct DOCTYPEs are generated.
0
 #
0
+# [<tt>:escape_html</tt>] Sets whether or not to escape HTML-sensitive characters in script.
0
+# If this is true, = behaves like &=;
0
+# otherwise, it behaves like !=.
0
+# <b>Note that this doesn't affect attributes or == interpolation.</b>
0
+# Defaults to false.
0
+#
0
 # [<tt>:suppress_eval</tt>] Whether or not attribute hashes and Ruby scripts
0
 # designated by <tt>=</tt> or <tt>~</tt> should be
0
 # evaluated. If this is true, said scripts are

Comments

    No one has commented yet.