mirror of
https://github.com/aantron/dream.git
synced 2025-12-31 00:03:52 -05:00
Example text tweaks
This commit is contained in:
parent
05d1bb5d18
commit
a0f4753ae2
@ -58,7 +58,7 @@ from the standard library. So, you can do things like this:
|
||||
|
||||
<!-- Hyperlink Dream.html_escape -->
|
||||
|
||||
**Security:**
|
||||
## Security
|
||||
|
||||
The template automatically passes strings through `Dream.html_escape` before
|
||||
inserting them into the output. This only applies to formats that can emit
|
||||
@ -90,13 +90,15 @@ you will see that the app safely formats the script tag as text.
|
||||
<br>
|
||||
|
||||
In general, if you are not using the templater, you should pass any text that
|
||||
will be included in HTML through `Dream.html_escape`, unless you can somehow
|
||||
guarantee that it does not contain the characters `<`, `>`, `&`, `"`, or `'`.
|
||||
Also, always use quoted attributes — the rules for escaping for unquoted
|
||||
will be included in HTML through `Dream.html_escape`, unless you can guarantee
|
||||
that it does not contain the characters `<`, `>`, `&`, `"`, or `'`. Also,
|
||||
always use quoted attribute values — the rules for escaping unquoted
|
||||
attributes are much more invasive.
|
||||
|
||||
<!-- TODO Link out to more template examples. -->
|
||||
<!-- TODO Recommend against generating <script>, CSS, etc. -->
|
||||
|
||||
<br>
|
||||
<br>
|
||||
|
||||
**Next steps:**
|
||||
|
||||
@ -1,5 +1,7 @@
|
||||
# Tutorial
|
||||
|
||||
<!-- Link to tutorial getting started instructions. -->
|
||||
|
||||
Dream's first several examples make up a **tutorial**. Each example is a
|
||||
complete project with a helpful `README`, and plenty of links to next steps and
|
||||
documentation. You can begin at [**`1-hello`**](1-hello#files), or look in the
|
||||
@ -15,7 +17,7 @@ list below and jump to whatever interests you!
|
||||
middleware!
|
||||
- [**`5-echo`**](5-echo/#files) — reads request bodies.
|
||||
- [**`6-template`**](6-template/#files) — renders responses
|
||||
from templates and guards against XSS.
|
||||
from inline HTML templates and guards against XSS.
|
||||
- [**`7-debug`**](7-debug/#files) — includes detailed
|
||||
information
|
||||
about errors in responses.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user