Ticket #6529: flatatt_with_conditional_escape.diff

django/forms/util.py

@@ -1 @@
-from django.utils.html import escape
+from django.utils.html import conditional_escape
 from django.utils.encoding import smart_unicode, StrAndUnicode, force_unicode
 from django.utils.safestring import mark_safe
 
@@ -9 +9 @@
     XML-style pairs.  It is assumed that the keys do not need to be XML-escaped.
     If the passed dictionary is empty, then return an empty string.
     """
-    return u''.join([u' %s="%s"' % (k, escape(v)) for k, v in attrs.items()])
+    return u''.join([u' %s="%s"' % (k, conditional_escape(v)) for k, v in attrs.items()])
 
 class ErrorDict(dict, StrAndUnicode):
     """

tests/regressiontests/forms/util.py

@@ -6 +6 @@
 tests = r"""
 >>> from django.forms.util import *
 >>> from django.utils.translation import ugettext_lazy
+>>> from django.utils.safestring import mark_safe
 
 ###########
 # flatatt #
@@ -16 +17 @@
 u' id="header"'
 >>> flatatt({'class': "news", 'title': "Read this"})
 u' class="news" title="Read this"'
+>>> flatatt({'onclick': mark_safe("javascript:{myFunction('string')}"), 'title': "Read this"})
+u' onclick="javascript:{myFunction(\'string\')}" title="Read this"'
 >>> flatatt({})
 u''