Example text tweaks

This commit is contained in:
Anton Bachin 2021-03-26 21:44:33 +03:00
parent 05d1bb5d18
commit a0f4753ae2
2 changed files with 9 additions and 5 deletions

View File

@ -58,7 +58,7 @@ from the standard library. So, you can do things like this:
<!-- Hyperlink Dream.html_escape -->
**Security:**
## Security
The template automatically passes strings through `Dream.html_escape` before
inserting them into the output. This only applies to formats that can emit
@ -90,13 +90,15 @@ you will see that the app safely formats the script tag as text.
<br>
In general, if you are not using the templater, you should pass any text that
will be included in HTML through `Dream.html_escape`, unless you can somehow
guarantee that it does not contain the characters `<`, `>`, `&`, `"`, or `'`.
Also, always use quoted attributes &mdash; the rules for escaping for unquoted
will be included in HTML through `Dream.html_escape`, unless you can guarantee
that it does not contain the characters `<`, `>`, `&`, `"`, or `'`. Also,
always use quoted attribute values &mdash; the rules for escaping unquoted
attributes are much more invasive.
<!-- TODO Link out to more template examples. -->
<!-- TODO Recommend against generating <script>, CSS, etc. -->
<br>
<br>
**Next steps:**

View File

@ -1,5 +1,7 @@
# Tutorial
<!-- Link to tutorial getting started instructions. -->
Dream's first several examples make up a **tutorial**. Each example is a
complete project with a helpful `README`, and plenty of links to next steps and
documentation. You can begin at [**`1-hello`**](1-hello#files), or look in the
@ -15,7 +17,7 @@ list below and jump to whatever interests you!
middleware!
- [**`5-echo`**](5-echo/#files) &nbsp;&mdash;&nbsp; reads request bodies.
- [**`6-template`**](6-template/#files) &nbsp;&mdash;&nbsp; renders responses
from templates and guards against XSS.
from inline HTML templates and guards against XSS.
- [**`7-debug`**](7-debug/#files) &nbsp;&mdash;&nbsp; includes detailed
information
about errors in responses.