Re: [htmltmpl] how to determine if tmpl_var exists in a loop?

[Karen J. C. <si...@ph...>]

On Sat, 17 Apr 2004, Puneet Kishor wrote:

PK>Interesting. I have approached this always with the attitude that I
PK>have to separate programming from display as much as possible. I've

Yes, but is the data part of the "programming," or part of the "display?"
In the case of this project, the data definition is part of the
programming for a *different* set of scripts, but this script is the UI
for settings maintenance (for/by the user).  Because the
nontechnical-user--friendliness is the paramount issue, it's the HTML
designer who gets to decide how the stuff is presented as far as layout,
the order things get handled on, and so on, so the script has to follow
the pattern set by the display in this case.

PK>sure... the user's actions would arrive to you (the cgi) as cgi params.
PK>Most all decisions can be made based on those. In fact, even before
PK>that, quite a few illogical user acts can be trapped with judicious use
PK>of javascript.

I'm not so concerned about illogical, but rather about hostile.  Because
it's going to be a public Internet app, I have to assume that some users
are going to look at the code and submit data that deliberately violates
it.  So the script has to know what list selections are permissible
(presently I feed those *from* the script via TMPL_LOOP), things like
that.  Client-side checking absolutely can't be trusted to do that.

-- 
Karen J. Cravens  si...@ph...