Escape ampersand and single quote?

[escholtz]

Looks like the escaper in the html package escapes single quotes:
https://golang.org/src/html/escape.go?s=3992:4005#L172

It appears that quicktemplate does not. Is that safe?

[valyala]

quicktemplate should escape single quotes - see the corresponding code and this test.

Could you provide a short quicktemplate example, which doesn't escape single quote?

[escholtz]

Ooops, you are correct. Thanks for the quick response and sorry for wasting your time.

On 2nd glance, looks like the html package also remaps & to &. Does that need to be added?

Test:

{% func TestEscapeAmpersand() %}
  {%s "&" %}
{% endfunc %}

[valyala]

looks like the html package also remaps & to &. Does that need to be added?

Yes! Fixed it!