#33405: Documentation for template filter 'escapejs' is extremely unclear
-------------------------------+--------------------------------------
Reporter: Jon Ribbens | Owner: nobody
Type: Bug | Status: closed
Component: Documentation | Version: 4.0
Severity: Normal | Resolution: invalid
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------------------------
Changes (by Carlton Gibson):
* status: new => closed
* resolution: => invalid
Comment:
This looks like a usage question really. For which see
TicketClosingReasons/UseSupportChannels.
Nonetheless, `escapejs` is used avoid syntax errors when constructing
Javascript using the DTL.
Take something like this:
{{{
<script>
function example() {
query = '{{ my_var | escapejs }}';
}
</script>
}}}
If `my_var` included a single quote `'`, without the `escapejs` you'd get
a
syntax error, since the string would be improperly closed. `escapejs` hex
encodes the `'` leaving a valid string.
In addition it encodes various other characters including `<`, and `>`
which
makes it look like it's good for security, but it's not. See #29055.
The source is in `django.utils.html` is you want to see exactly what's
encoded.
As I said above, I think the current text is ok **but** happy to look at
concrete suggestions for improvements to the docs.
--
Ticket URL: <https://code.djangoproject.com/ticket/33405#comment:3>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.307b4280069ae3392ee5e107bb68be3d%40djangoproject.com.
