From a0f4753ae2d610faafdc4eef009a91f0f8e5e394 Mon Sep 17 00:00:00 2001 From: Anton Bachin Date: Fri, 26 Mar 2021 21:44:33 +0300 Subject: [PATCH] Example text tweaks --- example/6-template/README.md | 10 ++++++---- example/README.md | 4 +++- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/example/6-template/README.md b/example/6-template/README.md index 54b43df..38b6f78 100644 --- a/example/6-template/README.md +++ b/example/6-template/README.md @@ -58,7 +58,7 @@ from the standard library. So, you can do things like this: -**Security:** +## Security The template automatically passes strings through `Dream.html_escape` before inserting them into the output. This only applies to formats that can emit @@ -90,13 +90,15 @@ you will see that the app safely formats the script tag as text.
In general, if you are not using the templater, you should pass any text that -will be included in HTML through `Dream.html_escape`, unless you can somehow -guarantee that it does not contain the characters `<`, `>`, `&`, `"`, or `'`. -Also, always use quoted attributes — the rules for escaping for unquoted +will be included in HTML through `Dream.html_escape`, unless you can guarantee +that it does not contain the characters `<`, `>`, `&`, `"`, or `'`. Also, +always use quoted attribute values — the rules for escaping unquoted attributes are much more invasive. + +

**Next steps:** diff --git a/example/README.md b/example/README.md index 70212a7..3d5c122 100644 --- a/example/README.md +++ b/example/README.md @@ -1,5 +1,7 @@ # Tutorial + + Dream's first several examples make up a **tutorial**. Each example is a complete project with a helpful `README`, and plenty of links to next steps and documentation. You can begin at [**`1-hello`**](1-hello#files), or look in the @@ -15,7 +17,7 @@ list below and jump to whatever interests you! middleware! - [**`5-echo`**](5-echo/#files)  —  reads request bodies. - [**`6-template`**](6-template/#files)  —  renders responses - from templates and guards against XSS. + from inline HTML templates and guards against XSS. - [**`7-debug`**](7-debug/#files)  —  includes detailed information about errors in responses.