pongo2
pongo2 copied to clipboard
filter linebreaks(br) and escaping
When you use the linebreaks(br)
filter, the input is usually pure text, not HTML.
If we replace \n
with <br \>
, then the output becomes HTML.
So it must be flagged as safe in the template.
Therefore, we need to do value | linebreaksbr | safe
in order to handle the inserted br correctly, which is not very user-friendly.
But now, the input is considered as safe, which is not necessarily true, because it could contain special HTML character.
So the input must also be escaped manually: value | escape | linebreaksbr | safe
: even less user-friendly.
Wouldn't it be simpler to call html.EscapeString()
at the beginning of the filter, and AsSafeValue()
at the end ?
Yes it's not backward compatible, but I think it makes more sense.