doc: update wiki article to use html/template properly.

Fixes #3569.

R=golang-dev, r
CC=golang-dev
https://golang.org/cl/6116055
This commit is contained in:
David Symonds 2012-04-26 17:50:44 +10:00
parent b28431ec8e
commit 4d3db77c69
3 changed files with 12 additions and 11 deletions

View file

@ -1,6 +1,6 @@
<h1>Editing {{.Title |html}}</h1>
<h1>Editing {{.Title}}</h1>
<form action="/save/{{.Title |html}}" method="POST">
<div><textarea name="body" rows="20" cols="80">{{printf "%s" .Body |html}}</textarea></div>
<form action="/save/{{.Title}}" method="POST">
<div><textarea name="body" rows="20" cols="80">{{printf "%s" .Body}}</textarea></div>
<div><input type="submit" value="Save"></div>
</form>

View file

@ -359,10 +359,10 @@ First, we must add <code>html/template</code> to the list of imports:
<pre>
import (
<b>"html/template"</b>
"http"
"io/ioutil"
"os"
<b>"html/template"</b>
)
</pre>
@ -397,10 +397,11 @@ Template directives are enclosed in double curly braces.
The <code>printf "%s" .Body</code> instruction is a function call
that outputs <code>.Body</code> as a string instead of a stream of bytes,
the same as a call to <code>fmt.Printf</code>.
The <code>|html</code> part of each directive pipes the value through the
<code>html</code> formatter before outputting it, which escapes HTML
characters (such as replacing <code>&gt;</code> with <code>&amp;gt;</code>),
preventing user data from corrupting the form HTML.
The <code>html/template</code> package helps guarantee that only safe and
correct-looking HTML is generated by template actions. For instance, it
automatically escapes any greater than sign (<code>&gt;</code>), replacing it
with <code>&amp;gt;</code>, to make sure user data does not corrupt the form
HTML.
</p>
<p>

View file

@ -1,5 +1,5 @@
<h1>{{.Title |html}}</h1>
<h1>{{.Title}}</h1>
<p>[<a href="/edit/{{.Title |html}}">edit</a>]</p>
<p>[<a href="/edit/{{.Title}}">edit</a>]</p>
<div>{{printf "%s" .Body |html}}</div>
<div>{{printf "%s" .Body}}</div>