Hello fellow monks,

Following up my own question in SOPW, I would like to release a module implementing the following concept.

TL;DR

use Text::Quote::Self qw(quote_text); my $safe = quote_text($user_input); # create a magic string object $safe = Text::Quote::Self->new($user_input); # ditto say $safe; # input as is say $safe->as_uri; # uri-encoded $safe =~ s/foo/bar/; # changes original, permanently my $data = { text => $safe }; # elsewhere in the app say JSON::XS->new->allow_blessed->convert_blessed->encode($data); #text as is local $Text::Quote::Self::Style = "as_html"; say $data->{text}; # now with entities # or in a Template You were searching for <a href="/search?q=[% search_term.as_uri %]">[% search_term %]</a>.

The concept

Say we have an application that produces convoluted data structure which can be presented in multi[ple ways (who said MVC?). Now depending on the presentation, some strings may need to be escaped/quoted, e.g. if we form an HTML document, we'll have to use HTML entities for some characters; but if we send it via JSON, no quoting is needed.

To encode such strings properly, we have to either know what presentation is to be used and pre-encode the strings in the data layer, or know which strings are safe and which aren't in the presentation layer. This breaks encapsulation of presentation and data, respectively.

Now my proposed solution is to create an object with overloaded stringify operation and a set of quoting methods. The preferred method is then chosen based on a package variable. This allows to localize choice to a scope, e.g. set to HTML during template processing subroutine.

The questions

Whatever is done so far is available on github.

  • Comment on RFC: Text::Quote::Self - A context-based self-quoting facade for unsafe strings
  • Download Code

Replies are listed 'Best First'.
Re: RFC: Text::Quote::Self - A context-based self-quoting facade for unsafe strings
by salva (Canon) on Jan 18, 2016 at 10:16 UTC
    To encode such strings properly, we have to either (...) or know which strings are safe and which aren't in the presentation layer.

    But you already know that: all the strings coming from other layers are potentially unsafe and should be escaped in the presentation layer.

    There may be cases where breaking the encapsulation may make your life simpler (passing preformatted data to the presentation layer) or you may like to use a special quoting mechanism (i.e. as_uri). But these should be the exceptions requiring special actions, no the other way around.

      Makes sense. Simpler AND safer. Somehow I overlooked this...