weberlangn2o

erlang n2o render get <span id=&quot

I want to write web with n2o and rebar3. but I get the page something wrong ,code is here.

index.erl

-module(index).
  -compile(export_all).
  -include_lib("n2o/include/wf.hrl").
  -include_lib("nitro/include/nitro.hrl").




  main() -> #dtl{file="prod",app=web, ext="dtl", bindings=[{body,body()} ]}.

  body() ->
      [ #span   { id=display },                #br{},
        #span   { body="Login: " },            #textbox{id=user,autofocus=true}, #br{},
        #span   { body="Join/Create Feed: " }, #textbox{id=pass},
        #button { id=loginButton, body="Login",postback=login,source=[user,pass]} ].

prod.dtl

<html >
<head>
  <title>{{title}}</title>
</head>
<body>
            {{body}}
</body>
</html>

I get the result :

<html >
<head>
  <title></title>
</head>
<body>
            &lt;span id=&quot;display&quot;&gt;&lt;/span&gt;&lt;br/&gt;&lt;span&gt;Login: &lt;/span&gt;&lt;input id=&quot;user&quot; type=&quot;text&quot; autofocus=&quot;true&quot;/&gt;&lt;br/&gt;&lt;span&gt;Join/Create Feed: &lt;/span&gt;&lt;input id=&quot;pass&quot; type=&quot;text&quot;/&gt;&lt;button id=&quot;loginButton&quot; type=&quot;button&quot;&gt;Login&lt;/button&gt;
</body>
</html>

how can i get get '<' not '&lt'

Solution

  • erlydtl enabled auto escaping of the values inside {{}} in this commit (also see #80 and #120). If you're using a version that includes this commit (from the page it looks like 0.9.0 or later), you'll have to manually mark the value as safe.

    Instead of:

    {{ body }}

    do:

    {{ body | safe }}

    Note: You should be aware of the risks of marking an untrusted string as safe: https://en.wikipedia.org/wiki/Cross-site_scripting.