Bug report: ESC applied to attribute values produces spurious output

[turnau at wemba.edu.pl]

> On Apr 30, 2013, at 12:33 PM, Jens Teich wrote:
>
>> Am 30.04.2013 21:19, schrieb Ron Garret:
>>> On Apr 30, 2013, at 12:13 PM, Jens Teich wrote:
>>> 
>>>> Am 30.04.13 21:02, schrieb Ron Garret:
>>>>> On Apr 30, 2013, at 11:47 AM, Stas Boukarev wrote:
>>>>> 
>>>>>> Ron Garret <ron at flownet.com> writes:
>>>>>> 
>>>>>>> ? (with-html-output-to-string (s) ((:a :href (esc "XXX")) (esc "YYY")))
>>>>>>> "<aXXX href='XXX'>YYY</a>"
>>>>>>> 
>>>>>>> My actual use case is:
>>>>>>> 
>>>>>>> (:a :onclick (esc "f('str')"))
>>>>>>> 
>>>>>>> This is CL-WHO 1.1.1 acquired through quicklisp.
>>>>>> That's not a bug, the attributes don't need STR or ESC.
>>>>>> (with-html-output-to-string (s) ((:a :href (escape-string "XXX")) (esc "YYY")))
>>>>> 
>>>>> Well, they need something if you want to embed a single-quoted string inside them:
>>>>> 
>>>>> ? (with-html-output-to-string (s) ((:input :type :button :onclick "alert('foo')")))
>>>>> "<input type='BUTTON' onclick='alert('foo')' />"
>>>> You need parenscript
>>>> 
>>>> :onclick (ps (alert ...))
>>> No, that won't help.  PS just produces the same troublesome string:
>>> 
>>> ? (parenscript::ps (alert "foo"))
>>> "alert('foo');"
>>> ? (with-html-output-to-string (s) ((:input :type :button :onclick (parenscript::ps (alert "foo")))))
>>> "<input type='BUTTON' onclick='alert('foo');' />"
>>> 
>>> 
>>> 
>> (setq ps:*js-string-delimiter* #\" )
>
> Ooh!  So close!  Turns out this exposes a bug in parenscript:
>
> ? (setq ps:*js-string-delimiter* #\" )
> #\"
> ? (princ (ps:ps (alert "'\"")))
> alert("\'"");
> "alert(\"\\'\"\");"
>
> But I guess this is close enough for my current needs.  Thanks!
>
> rg

How about this:

(setq cl-who:*attribute-quote-char* #\")

(cl-who:with-html-output-to-string (s) ((:input :type :button :onclick "alert('foo')")))
"<input type=\"BUTTON\" onclick=\"alert('foo')\" />"

PT