Pesan ini bikin mehe, bukan apa-apa, saya browsing postingan blog itu pake Desktop RSS aggregator, jarang saya punya kesempatan buat blogwalking dengan browser. Masalahnya hampir semua RSS aggregator yang ada di windows itu make embedded HTML engine punyanya IE.

moga-moga itu pesan ndak perlu dimunculin lagi deh. saran yang baik sebenarnya sih, cuman… agak mengganggu kenyamanan..

#6: Actually, I’m not very fond of this ‘dualism’, in this context and especially in comments. It should be either we escape all data, or we don’t escape them at all, or else we would have trouble unescaping. I would prefer escaping everything to be sure we are generating correct HTML. Comment posters can copy paste from character map if they really need to insert funny characters. If they need formatting, use something like wiki syntax, bbcode or markdown. No need to use hacks like balancetags. OK, enough rambling for now

#7: That’s the real world example why I don’t like this escaping ‘dualism’. It is very hard to insert HTML in comments

For example, if you add a properly encoded url to your link manager, e.g. “http://example.com/?q=foo&z=bar”, htmlspecialchars will encode the amp, giving you:

http://example.com/?q=foo&z=bar

The htmlentities2() function detects already-encoded entities, and leaves them alone. (it’s found in wp-includes/functions.php, and the code came from php.net, BTW)