The current documentation for format_string() emphasizes that it is to be used for "sanitizing" text but that's not really a complete description. Even if you trust the source of your text, you still want to run it through e.g. check_plain() if there's any chance it might contain a character that will be erroneously interpreted as HTML, and format_string() is a good way to do that.

Thus, we really should encourage people to use this function regardless of whether untrusted user input is involved. (See discussion in #500866: [META] remove t() from assert message.)

The attached patch is a first pass at trying to clarify the documentation in this regard and otherwise make some small improvements to it.

Files: 
CommentFileSizeAuthor
#4 format-string-docs-1873608-4.patch823 bytesDavid_Rothstein
PASSED: [[SimpleTest]]: [MySQL] 49,662 pass(es).
[ View ]
#1 format-string-docs-1873608-1.patch2.5 KBDavid_Rothstein
PASSED: [[SimpleTest]]: [MySQL] 49,445 pass(es).
[ View ]

Comments

Status:Active» Needs review
StatusFileSize
new2.5 KB
PASSED: [[SimpleTest]]: [MySQL] 49,445 pass(es).
[ View ]

Here's the patch.

Status:Needs review» Reviewed & tested by the community
Issue tags:+needs backport to D7

I think this is an excellent update to the documentation of this function. Thanks!

Status:Reviewed & tested by the community» Fixed

Committed and pushed to 8.x and 7.x. Thanks!

Status:Fixed» Needs review
StatusFileSize
new823 bytes
PASSED: [[SimpleTest]]: [MySQL] 49,662 pass(es).
[ View ]

Hm, I think I managed to tell people to use this function in one paragraph and then tell them not to use it the next.

This patch tries to clarify that...

Status:Needs review» Reviewed & tested by the community

I have no problem with that addition to the documentation in #4, although I don't think it's totally necessary. :)

Status:Reviewed & tested by the community» Fixed

Committed to 7.x and 8.x. Thanks!

Automatically closed -- issue fixed for 2 weeks with no activity.

Issue summary:View changes

Fix typo.