Forum OpenACS Development: Response to HTML quoting in the templating system

Collapse
Posted by Hrvoje Niksic on
Jeff, thanks for bringing this up. I very much wanted noquote to be included in OpenACS. Despite the initial agreement, this didn't happen because I didn't have time to initiate a public discussion, which Don and Ben requested. I hope this will provide an opportunity to rectify the situation.

Aside from what was said in the article, I'll try to briefly describe the advantages and the possible gotchas.

I still think noquote is an much-needed addition to ACS. We went with it in ShareNet (which my original article doesn't mention) and never regretted it. noquote takes very little time to get used to, and rids you of otherwise almost inevitable quoting bugs and many important security problems (!) without any additional effort.

There is a separate document describing porting existing pages to the noquote semantics in some detail:

http://jagor.srce.hr/~hniksic/no-quote-upgrade.html
Some people have expressed concern about the speed of wrapping almost all variables in [ad_quotehtml $var]. To make sure there is no slow-down for very large pages, we included an optional C implementation of ad_quotehtml. This should not be taken to mean that noquote slows down ACS so much as to *require* C code to work. The alternate ad_quotehtml is only provided as an add-on to make sure that high-performance sites that serve huge ADPs are not hindered with the change.

One thing you might want to be careful about is backward compatibility. At the time we introduced noquote, ACS 4 was pretty much an in-house thing. This is no longer the case with OpenACS. To keep the existing pages running, you might want to start by making noquote optional, off by default and turned on by a magic cookie in the ADP and/or by a flag to ad_return_template. I'm not sure if this would work correctly with includes and masters, but it's certainly worth a try.

If someone is willing to work on this on OpenACS side, I'm willing to provide help: the original patches, insight into the idea behind the changes, as well as other random improvements to the templating system that have accumulated in the ShareNet code base.