Interpolation in filters should not be escaped

arnaud-lb / MtHaml

Multi target HAML (HAML for PHP, Twig, <your language here>)

Other

359 stars 54 forks source link

Open weotch opened 8 years ago

weotch commented 8 years ago

From the HAML docs:

Currently, filters ignore the :escape_html option. This means that #{} interpolation within filters is never HTML-escaped.

Currently, in MtHaml, this...

:php
  $code = "var msg='hi';";
:javascript
  #{$code}

Results in:

<script type="text/javascript">
//<![CDATA[
   var msg=&#039;hi&#039;;  
//]]>
</script>

It should be:

<script type="text/javascript">
//<![CDATA[
   var msg='hi';  
//]]>
</script>

weotch commented 8 years ago

As a workaround, you can do:

:php
  $code = "var msg='hi';";
%script(type="text/javascript")
  :plain
    // Other JS code
  :php
    echo $code;
  :plain
    // More JS code