Masterview devel - Oct 2006 - Safer code in rendered output

When rendering the directives into tags, you should almost always use
the ''fn(p1, p2)'' form rather than the ''fn  p1,
p2'' style. This is
because you can''t predict what extra options the users are going to
put on the mv: directives. W/o doing this, some ERb stuff is going to
barf in Ruby because eventually, it all gets compiled down to a call
to:
 _erbout(  .... )

Passing multiple hashes to mv: directives like mv:form in order to put
html_options will cause this
problem.

Note: You can get around the problem by explicitly parenthesizing
stuff like this:

<form .... mv:form="({:action => ''chart''},  {:name
=> ''chart''})">

It may look prettier in the rendered output, but you should always opt
for the safer output.

Ed
-- 
Ed Howland
http://greenprogrammer.blogspot.com

On 10/9/06, Ed Howland <ed.howland at gmail.com>
wrote:
> When rendering the directives into tags, you should almost always use
> the ''fn(p1, p2)'' form rather than the ''fn  p1,
p2'' style. This is
> because you can''t predict what extra options the users are going
to
> put on the mv: directives. W/o doing this, some ERb stuff is going to
> barf in Ruby because eventually, it all gets compiled down to a call
> to:
>  _erbout(  .... )
>
> Passing multiple hashes to mv: directives like mv:form in order to put
> html_options will cause this
> problem.
>
> Note: You can get around the problem by explicitly parenthesizing
> stuff like this:
>
> <form .... mv:form="({:action => ''chart''}, 
{:name => ''chart''})">
>
> It may look prettier in the rendered output, but you should always opt
> for the safer output.
>
> Ed
> --
We do test the ability to pass in multiple hashes with the directives
but you are right that it can get tricky depending on the scenario.

I did have some directive tests for multiple hashes (link_to) and
others so we were trying to make sure that they worked.

However let me go back and review those test cases and also make sure
that erb was working with the output of those as well. Sounds like you
for sure hit a situation when it didn''t.

If that is the case then it is fairly easy change to change to
method() style output with the new refactoring. And I think you are
right in that it is safer (easier for the parser to interpret).

Thanks for the heads up.

Jeff