Combo.SafeHTML (combo v0.8.0)
View SourceProvides HTML safety utilities.
Its main functionality is to provide convenience functions for:
- escaping HTML as iodata.
- marking escaped HTML as safe tuple.
- converting escaped iodata or safe tuple into string.
- ...
Summary
Functions
Escapes given string for use as HTML content.
Escapes a term as the key of an attribute.
Escapes a term as the value of an attribute.
Escapes an enumerable of attributes, returning iodata.
Converts a safe into a string.
Converts arbitrary data into escaped iodata.
Converts unsafe into safe.
Types
@type safe() :: {:safe, iodata()}
Guaranteed to be safe.
@type unsafe() :: Combo.SafeHTML.Safe.t()
May be safe or unsafe. To use it safely, conversion is required.
Functions
Escapes given string for use as HTML content.
Examples
iex> escape("hello")
"hello"
iex> escape("<hello>")
[[[], "<"], "hello", ">"]
Escapes a term as the key of an attribute.
Escapes a term as the value of an attribute.
Escapes an enumerable of attributes, returning iodata.
The attributes are rendered in the given order. Note if a map is given, the key ordering is not guaranteed.
The keys and values can be of any shape, as long as they implement the
Combo.SafeHTML.Safe protocol.
Additionally, there are values which have special meanings when they are used as the values of tag attributes:
if a value is
true, the attribute is treated as boolean attribute, and it will be rendered with no value at all.if a value is
falseornil, the attribute is treated as boolean attribute, and it won't be rendered at all.
Examples
iex> IO.iodata_to_binary escape_attrs(title: "the title", id: "the id")
" title=\"the title\" id=\"the id\""
iex> IO.iodata_to_binary escape_attrs(selected: true)
" selected"
iex> IO.iodata_to_binary escape_attrs(hidden: false)
""
Converts a safe into a string.
Fails if the result is not safe. In such cases, you can invoke to_safe/1
or raw/1 accordingly.
You can combine to_safe/1 and safe_to_string/1 to convert a data
structure to an escaped string:
data |> to_safe() |> safe_to_string()
Converts arbitrary data into escaped iodata.
Examples
iex> to_iodata("<hello>")
[[[], "<"], "hello", ">"]
iex> to_iodata(~c"<hello>")
["<", 104, 101, 108, 108, 111, ">"]
iex> to_iodata(1)
"1"
iex> to_iodata({:safe, "<hello>"})
"<hello>"
Converts unsafe into safe.
Examples
iex> to_safe("<hello>")
{:safe, [[[], "<"], "hello", ">"]}
iex> to_safe(~c"<hello>")
{:safe, ["<", 104, 101, 108, 108, 111, ">"]}
iex> to_safe(1)
{:safe, "1"}
iex> to_safe({:safe, "<hello>"})
{:safe, "<hello>"}