Skip to content
This repository has been archived by the owner on Jan 29, 2020. It is now read-only.

Documentation for the "Good" URL escaping is still not good #31

Open
2 tasks done
stof opened this issue May 18, 2018 · 1 comment
Open
2 tasks done

Documentation for the "Good" URL escaping is still not good #31

stof opened this issue May 18, 2018 · 1 comment

Comments

@stof
Copy link

stof commented May 18, 2018

  • I was not able to find an open or closed issue matching what I'm seeing.
  • This is not a question. (Questions should be asked on chat (Signup here) or our forums.)

The example used on https://docs.zendframework.com/zend-escaper/escaping-url/ is not only building a URL. It is also outputting this URL in an HTML context. So this is a case of nested contexts:

  • the name must be escaped as URL component (good)
  • the whole URL must be escaped as HTML attribute value (not good currently)

This is kind of unfortunate to show this as a good usage of escaping when a previous chapter was precisely warning about nested contexts.

The example should either be improved to apply the necessary HTML escaping, or be replaced by another example using the URL in a non-HTML context.

@weierophinney
Copy link
Member

This repository has been closed and moved to laminas/laminas-escaper; a new issue has been opened at laminas/laminas-escaper#1.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants