On 2014-01-16 4:03 PM, Paul Wilson wrote:
>
> In _includes/disqus.html:
>
> > @@ -3,8 +3,8 @@
> >    <script type="text/javascript">
> >      var disqus_shortname = 'software-carpentry';
> >      var disqus_developer = 1;
> > -    var disqus_identifier = '{{page.filename}}';
> > -    var disqus_title = '{{page.title}}';
> > +    var disqus_identifier = "{{page.filename}}";
> > +    var disqus_title = "{{page.title}}";
>
> Will this still work if someone put's a quotation mark in a title? Do 
> we need a solution that more completely sanitizes the variable?
>
I think we should sanitize. But I'm puzzled: when I look at compiled 
pages on the site, I see:

   <script  type="text/javascript">
     var disqus_shortname = 'software-carpentry';
     var disqus_developer = 1;
     var disqus_identifier = '';
     var disqus_title = 'Blog';
     (function() {
       var dsq = document.createElement('script'); dsq.type = 'text/javascript'; dsq.async = true;
       dsq.src = 'http://' + disqus_shortname + '.disqus.com/embed.js';
       (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(dsq);
     })();
   </script>

i.e., the disqus_identifier variable is an empty string.