I don't have any problem adding these, but I'm not sure what is better about the changes?
In my view, the code is easier to read in the html source if not escaped. It adds extra PHP processing (however slight). And it seems to validate well enough with the current code. Just for my own benefit, could you clarify the reasons for the changes? Cheers, Dan On Fri, Sep 26, 2008 at 6:00 AM, blues <[EMAIL PROTECTED]> wrote: > > i just noticed that the html tags attributes values are not escaped > but outputted on the browser as-is. > it also is better to enclose them in double quotes instead than > single, because for some reasons the escaping of the single quote does > not work very well. > > i think escaping with htmlentities should be enough. > for example in markups.php, function BOLTMlinks, line 432, in place > of: > > $attr .= " $f='$v' "; > > it should be: > > $attr .= " $f=\"" . htmlentities($v, ENT_COMPAT, 'UTF-8') . "\" "; > > > the same goes for: > function BOLTMstyles, line 554 > function BOLTMtables, line 589 > function BOLTMuploads, line 648 and 671 > > maybe there also other places where the above apply. > > > blues > > > --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "BoltWire" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/boltwire?hl=en -~----------~----~----~----~------~----~------~--~---
