celtric/kotlin-html

A library to generate HTML in Kotlin.

kotlin-html's Issues

Strings should be escaped based on context

It would be safer if strings were escaped based on context. In particular:

• HTML escaping inside of most HTML elements

  i("1<2").render() shouldBe "<i>1&lt;2</i>"
  
  expected: "<i>1&lt;2</i>" but was: "<i>1<2</i>"
  

• Attribute escaping inside attribute values:

  img(src="\"&.png", alt="fred").render() shouldBe "<img src=\"&quot;&amp;.png\" alt=\"fred\">"
  
  expected: "<img src="&quot;&amp;.png" alt="fred">" but was: "<img src=""&.png" alt="fred">"
  

• The script and style elements are pretty weird, and would probably need special handling. HTML escaping inside of them makes no sense, but on the other hand, they cannot contain their respective end-tag verbatim. (I think the rules are actually even more strict than this. In Html 4.01, even "</" wasn't allowed in either. It looks like the same is true at least for script in HTML 5, I'm not sure about style.)

Port it to PHP

Would be great if you could rewrite this in PHP. For science