Home » HTML » HTML_QuickForm » Bug #7189

[2006-03-24 00:44 UTC] nigel at catalyst dot net dot nz

Description:
------------
When using QuickForm to create a <select> dropdown, I often build it using a query:

$res = sql_do('SELECT position_type, position_type_id FROM position_type ORDER BY position_type');
$pos_type =& $form->addElement('select', 'position_type', 'Position Types:');
$pos_type->load($res);

(assume sql_do is a function that returns a PEAR::DB result object).

This builds a select list, but does not escape either column for HTML output.

Admittedly sometimes this may be useful, but I think that in the vast majority of times people would want to have the columns escaped for HTML output.

Test script:
---------------
See above: simply create a select QuickForm element and populate it using a PEAR::DB result.

Expected result:
----------------
The output select should be HTML escaped (htmlspecialchars or other means), e.g:

<select name="position_type_id">
<option value="1"><my position></option>
</select>

Actual result:
--------------
<select name="position_type_id">
<option value="1"><my position></option>
</select>