jamuhl/i18next — pull request #106 by anderslemke (2013-05-02 07:08:51+00:00)
Title: Option for escaping replacement

Hi jamuhl,

Here at Issuu we're exited about using i18next. Thanks for the great work.

We're proposing this change, based on these assumptions:

* We, as developers, have control of what goes into the dictionaries.
* We, as developers, do not always have control of the values inserted into translations. I.e. it might be from user input.

To avoid the risk of XSS we would like to have the inserted values escaped by default, with an option for not escaping by explicit indication.

This feature is turned off in i18next by default, but you can turn it on, on init or by options with

escapeInterpolation: true

When turned on, given the following keys in the dictionary

"key1": "Not escaped __nameHTML___"
"key2": "Escaped __name___"

these are the results

t('key1', {name: ''}); // => Not escaped
t('key2', {name: ''}); // => Escaped <tag>

What do you think?