select attributes should be escaped
authorSylvain Thénault <sylvain.thenault@logilab.fr>
Mon, 27 Jul 2009 18:37:09 +0200
changeset 2517 d664652b7f9c
parent 2516 b58826130680
child 2518 38c28ee40138
select attributes should be escaped
common/tags.py
--- a/common/tags.py	Mon Jul 27 18:36:51 2009 +0200
+++ b/common/tags.py	Mon Jul 27 18:37:09 2009 +0200
@@ -7,7 +7,7 @@
 """
 __docformat__ = "restructuredtext en"
 
-from cubicweb.common.uilib import simple_sgml_tag
+from cubicweb.common.uilib import simple_sgml_tag, sgml_attributes
 
 class tag(object):
     def __init__(self, name, escapecontent=True):
@@ -38,8 +38,7 @@
     if id:
         attrs['id'] = id
     attrs['name'] = name
-    html = [u'<select %s>' % ' '.join('%s="%s"' % kv
-                                      for kv in sorted(attrs.items()))]
+    html = [u'<select %s>' % sgml_attributes(attrs)]
     html += options
     html.append(u'</select>')
     return u'\n'.join(html)