It's even worse than I imagined.

Leaving off the T() operation, I find that my field labeled "LCM >" is 
actually sanitized at some point into:

<label class="control-label col-sm-5" for="event_join_lcm_gt" 
id="event_join_lcm_gt__label">LCM &gt;: </label>

Yes, something in the process has *recognized* the character ">" and 
changed it to "&gt;"  But the field "LCM &le;" was sanitized into:

<label class="control-label col-sm-5" for="event_join_lcm_le" 
id="event_join_lcm_le__label">LCM &amp;le;: </label>

In this case, not only was the &le; *not recognized* by the sanitizer, it 
actually DE-SANITZED it by removing the ampersand and sanitizing it 
separately.

This is the problem with automatic "stuff" -- such as hidden magic 
sanitization.  When it goes wrong, it goes very wrong.  And you need to 
spend hours with the source trying to figure out where it went wrong and if 
there's an easy fix without modifying the distro.

-- Joe

-- 
Resources:
- http://web2py.com
- http://web2py.com/book (Documentation)
- http://github.com/web2py/web2py (Source code)
- https://code.google.com/p/web2py/issues/list (Report Issues)
--- 
You received this message because you are subscribed to the Google Groups 
"web2py-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to web2py+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to