Let HTML.escape only escape &<>"'

[asterite]

Fixes #3233

According to OWSAP these are the only ones that should be escaped. Well, actually, they also recommend escaping /. However, Ruby, Python and Go just escape these, so I think it's pretty safe if we do the same thing.

About unescape: maybe more (all) named chars should be unescaped, but it's out of the scope of this PR.

This basically undoes #2175, which was a mistake.

[asterite]

For documentation purposes

…

On Wed, Sep 20, 2017 at 10:16 AM, Benoit de Chezelles < ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In src/html.cr <#5012 (comment)>: > # # ``` # HTML.unescape("Crystal &amp; You") # => "Crystal & You" # ``` - def self.unescape(string : String) + def self.unescape(string : String) : String Why do you explicitly specify the return type here? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#5012 (review)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAMx28yMlJgy_fKRMies1gn0pWeir8Uoks5skRAzgaJpZM4Pd18n> .

[akzhan]

Yes, it's original idea just to rollback bad change :)