Commit 4d3db77c authored by David Symonds's avatar David Symonds

doc: update wiki article to use html/template properly.

Fixes #3569.

R=golang-dev, r
CC=golang-dev
https://golang.org/cl/6116055
parent b28431ec
<h1>Editing {{.Title |html}}</h1>
<h1>Editing {{.Title}}</h1>
<form action="/save/{{.Title |html}}" method="POST">
<div><textarea name="body" rows="20" cols="80">{{printf "%s" .Body |html}}</textarea></div>
<form action="/save/{{.Title}}" method="POST">
<div><textarea name="body" rows="20" cols="80">{{printf "%s" .Body}}</textarea></div>
<div><input type="submit" value="Save"></div>
</form>
......@@ -359,10 +359,10 @@ First, we must add <code>html/template</code> to the list of imports:
<pre>
import (
<b>"html/template"</b>
"http"
"io/ioutil"
"os"
<b>"html/template"</b>
)
</pre>
......@@ -397,10 +397,11 @@ Template directives are enclosed in double curly braces.
The <code>printf "%s" .Body</code> instruction is a function call
that outputs <code>.Body</code> as a string instead of a stream of bytes,
the same as a call to <code>fmt.Printf</code>.
The <code>|html</code> part of each directive pipes the value through the
<code>html</code> formatter before outputting it, which escapes HTML
characters (such as replacing <code>&gt;</code> with <code>&amp;gt;</code>),
preventing user data from corrupting the form HTML.
The <code>html/template</code> package helps guarantee that only safe and
correct-looking HTML is generated by template actions. For instance, it
automatically escapes any greater than sign (<code>&gt;</code>), replacing it
with <code>&amp;gt;</code>, to make sure user data does not corrupt the form
HTML.
</p>
<p>
......
<h1>{{.Title |html}}</h1>
<h1>{{.Title}}</h1>
<p>[<a href="/edit/{{.Title |html}}">edit</a>]</p>
<p>[<a href="/edit/{{.Title}}">edit</a>]</p>
<div>{{printf "%s" .Body |html}}</div>
<div>{{printf "%s" .Body}}</div>
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment