Hacker News Reader

Full thread

schemescape

I didn’t see anything about escaping values going into template literals. Did I miss it?

That seems important for anything involving user input.

Edit: Escaping rules also differ on context (HTML, attribute, URIs, script tags, etc.), so it’s not trivial.

View on HN

This is handled by the DOM automatically in arrow since it uses things like “el.setAttribute” and “el.innerText”

The examples in the docs show HTML in string format. Does it parse the string to determine the context?

> t`<button @click="${() => data.clicks++}">Fired ${() => data.clicks} arrows</button>`

If so, that is impressive, and something I'd love to use!

Edit: I'm asking because I attempted to use template literals for HTML templates and escaping values is the trickiest part. I settled for requiring the caller to tell me what kind of escaping to use (with the default being very conservative).

In the "Events" section of the docs, there's a text box you can type into and the contents get inserted into an "em" element below the text box. If I type HTML into that box, it adds additional HTML elements to the page, so that seems like escaping isn't working.

Is that a bug or am I just not understanding what you're saying?

Reply on news.ycombinator.com