Closed zentrope closed 10 years ago
Agree, it would be very useful to be able to use unescaped HTML as node text (as an option)
Actually, it seems that dommy.template/html->nodes
get string with some markup in it and returns set of html nodes. So, it may be used to indicate that we don't need to escape text snippet:
(deftemplate x
[:div.class
(html->nodes "some — <i>html</i>")])
Sorry for the late response.
Nesting html->nodes
is the preferred way as @tonsky pointed out, though maybe it would be better to make escaping opt-in.
There does need to be a more convenient way to insert raw HTML, but please do not make escaping opt-in. You'd end up with the security-disaster that is hiccup. I suggest creating a raw
function that the rare fragments of HTML can be more easily wrapped in. The developer can focus on those small sections to validate their code is structurally sound and doesn't contain injection vulnerabilities.
Perhaps for HTML entities a keyword syntax like this : 
could be used to make this more convenient?
[:div "message" :  "here"]
Yeah makes sense for security to default to escaping..
To recap, if you want to insert raw html fragments, wrap the html in html->nodes
within your template.
Oh and @orb, special character keywords sound interesting.
I tried something like:
then
I see a literal "
" rather than a space. Same with•
or©
, etc, etc.Principal-of-least-surprise suggests those should actually render properly, but I'm okay with there being some other way to do this.
works just fine. However, using
set-text!
seems to quote the character entities. Might the node macro need to treat that text as HTML or something?