At the time when we came to realize how serious the quoting +
At the time when we came to realize how serious the quoting deficiencies of ACS 4.0 were, we were about two weeks away from the release of a project for the German Bank. There was simply no time to hunt all the places where a variable needs to be quoted and -implement one of the above quoting tricks.
-While examining the ADPs, we noticed that most substituted -variable fall into one of three categories:
- -While examining the ADPs, we noticed that most substituted +variable fall into one of three categories:
Those that need to be quoted -- names and descriptions of -objects, and in general stuff that ultimately comes from the user.
Those for which it doesn't make a difference whether they are -quoted or not -- e.g. all the database IDs.
Those that must not be quoted -- e.g. exported form vars stored -to a variable.
Finally we also remembered the fact that almost none of the +objects, and in general stuff that ultimately comes from the +user.
Those for which it doesn't make a difference whether they are +quoted or not -- e.g. all the database IDs.
Those that must not be quoted -- e.g. exported form vars stored +to a variable.
Finally we also remembered the fact that almost none of the variables are quoted in the current source base.
Our reasoning went further: if it is a fact that most variables +
Our reasoning went further: if it is a fact that most variables are not quoted, and if the majority of variables either require quoting or are not harmed by it, then we are in a much better position if we make the templating system quote all variables by default! That way @@ -169,9 +158,7 @@ need to be marked as noquote to function correctly. But even those should not be a problem, because HTML code that ends up quoted in the page is immediately visible, and all you need to do to fix it -is add the marker.
- -We decided to test whether the idea will work by attempting to +is add the marker.
We decided to test whether the idea will work by attempting to convert our system to work that way. I spent several minutes making the change to the templating system. Then we went through all the ADPs and replaced the instances of \@foo\@ where foo contained HTML