Comparison

util/stanza.lua @ 338:804f5e62a41f

Don't forget to escape XML in attributes. Thanks to the Postgres Q&A room on conference.jabber.org :)
author Matthew Wild <mwild1@gmail.com>
date Wed, 19 Nov 2008 05:02:13 +0000
parent 262:8c73fb2ff4a2
child 373:dd0345edeaf4
comparison
equal deleted inserted replaced
337:4a1dd1c2c219 338:804f5e62a41f
101 end 101 end
102 end 102 end
103 103
104 local attr_string = ""; 104 local attr_string = "";
105 if t.attr then 105 if t.attr then
106 for k, v in pairs(t.attr) do if type(k) == "string" then attr_string = attr_string .. s_format(" %s='%s'", k, tostring(v)); end end 106 for k, v in pairs(t.attr) do if type(k) == "string" then attr_string = attr_string .. s_format(" %s='%s'", k, xml_escape(tostring(v))); end end
107 end 107 end
108 return s_format("<%s%s>%s</%s>", t.name, attr_string, children_text, t.name); 108 return s_format("<%s%s>%s</%s>", t.name, attr_string, children_text, t.name);
109 end 109 end
110 110
111 function stanza_mt.top_tag(t) 111 function stanza_mt.top_tag(t)
112 local attr_string = ""; 112 local attr_string = "";
113 if t.attr then 113 if t.attr then
114 for k, v in pairs(t.attr) do if type(k) == "string" then attr_string = attr_string .. s_format(" %s='%s'", k, tostring(v)); end end 114 for k, v in pairs(t.attr) do if type(k) == "string" then attr_string = attr_string .. s_format(" %s='%s'", k, xml_escape(tostring(v))); end end
115 end 115 end
116 return s_format("<%s%s>", t.name, attr_string); 116 return s_format("<%s%s>", t.name, attr_string);
117 end 117 end
118 118
119 function stanza_mt.__add(s1, s2) 119 function stanza_mt.__add(s1, s2)