Closed zulqasar closed 5 months ago
This may be a bit confusing at first, but attributes are always escaped, regardless of whether or not it contains markup. This is a feature and this allows you to actually pass HTML fragments or script fragments.
Consider this htpy code:
button(onclick="let name = 'andreas'; alert('hi' + name);")["Say hi"]
The value of the attributes is escaped with '
to avoid breaking the quotes. The browser understands that and parses it as the proper quotes so it all works:
I realized that this behavior is not documented, will add a note to the docs about it!
Thanks for the quick reply. It addresses my concerns.
Reopening this issue until it's documented properly 🙂
First and foremost, THANKS for this awesome library.
I am having trouble with Markup. Am I missing out on something?