mirror of
https://github.com/golang/go
synced 2024-11-21 19:54:41 -07:00
doc: update wiki article to use html/template properly.
Fixes #3569. R=golang-dev, r CC=golang-dev https://golang.org/cl/6116055
This commit is contained in:
parent
b28431ec8e
commit
4d3db77c69
@ -1,6 +1,6 @@
|
|||||||
<h1>Editing {{.Title |html}}</h1>
|
<h1>Editing {{.Title}}</h1>
|
||||||
|
|
||||||
<form action="/save/{{.Title |html}}" method="POST">
|
<form action="/save/{{.Title}}" method="POST">
|
||||||
<div><textarea name="body" rows="20" cols="80">{{printf "%s" .Body |html}}</textarea></div>
|
<div><textarea name="body" rows="20" cols="80">{{printf "%s" .Body}}</textarea></div>
|
||||||
<div><input type="submit" value="Save"></div>
|
<div><input type="submit" value="Save"></div>
|
||||||
</form>
|
</form>
|
||||||
|
@ -359,10 +359,10 @@ First, we must add <code>html/template</code> to the list of imports:
|
|||||||
|
|
||||||
<pre>
|
<pre>
|
||||||
import (
|
import (
|
||||||
|
<b>"html/template"</b>
|
||||||
"http"
|
"http"
|
||||||
"io/ioutil"
|
"io/ioutil"
|
||||||
"os"
|
"os"
|
||||||
<b>"html/template"</b>
|
|
||||||
)
|
)
|
||||||
</pre>
|
</pre>
|
||||||
|
|
||||||
@ -397,10 +397,11 @@ Template directives are enclosed in double curly braces.
|
|||||||
The <code>printf "%s" .Body</code> instruction is a function call
|
The <code>printf "%s" .Body</code> instruction is a function call
|
||||||
that outputs <code>.Body</code> as a string instead of a stream of bytes,
|
that outputs <code>.Body</code> as a string instead of a stream of bytes,
|
||||||
the same as a call to <code>fmt.Printf</code>.
|
the same as a call to <code>fmt.Printf</code>.
|
||||||
The <code>|html</code> part of each directive pipes the value through the
|
The <code>html/template</code> package helps guarantee that only safe and
|
||||||
<code>html</code> formatter before outputting it, which escapes HTML
|
correct-looking HTML is generated by template actions. For instance, it
|
||||||
characters (such as replacing <code>></code> with <code>&gt;</code>),
|
automatically escapes any greater than sign (<code>></code>), replacing it
|
||||||
preventing user data from corrupting the form HTML.
|
with <code>&gt;</code>, to make sure user data does not corrupt the form
|
||||||
|
HTML.
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
<h1>{{.Title |html}}</h1>
|
<h1>{{.Title}}</h1>
|
||||||
|
|
||||||
<p>[<a href="/edit/{{.Title |html}}">edit</a>]</p>
|
<p>[<a href="/edit/{{.Title}}">edit</a>]</p>
|
||||||
|
|
||||||
<div>{{printf "%s" .Body |html}}</div>
|
<div>{{printf "%s" .Body}}</div>
|
||||||
|
Loading…
Reference in New Issue
Block a user