Module: Hecks::Forms::Escape

Defined in:
lib/hecks/forms/html.rb

Overview

Hand-rolled, on purpose — the repo has no ERB anywhere and no template engine dependency (see docs/command-form-and-query-form-bluebook.md's survey). Every other generator in this codebase (bin/reference's markdown, the IR's own to_h) builds output as plain Ruby strings; this does the same for HTML, with exactly one job: nothing that reaches Escape.html ever becomes a tag. A feature developer's own domain data — a customer's name, an account number a support rep typed into a form and got wrong — flows through here on every render, so escaping is not optional decoration.

Class Method Summary collapse

Class Method Details

.attr(value) ⇒ Object

Safe inside a double-quoted HTML attribute specifically — html already covers this (it escapes "), kept as a named alias so a call site reads "this value fills an attribute" rather than repeating the same escaping and leaving the reader to check they match.



27
 
# File 'lib/hecks/forms/html.rb', line 27

def self.attr(value) = html(value)

.html(value) ⇒ Object

Order matters — & first, or every escape this method itself just wrote (&, <, ...) gets re-escaped a second time.



14
15
16
17
18
19
20
21
 
# File 'lib/hecks/forms/html.rb', line 14

def self.html(value)
  value.to_s
       .gsub("&", "&")
       .gsub("<", "&lt;")
       .gsub(">", "&gt;")
       .gsub('"', "&quot;")
       .gsub("'", "&#39;")
end