Ensure book title/summary are not escaped twice

[hamishwillee]

Fix #5320

This displays the data in book detail title & summary unescaped. That's OK because the form only displays data that has already been sanitized. If we don't do this it gets sanitized on display, so we see the sanitization code we added on saving.

Demo side is:

• Book detail - stop escaping already escaped title/summary express-locallibrary-tutorial#305

[github-actions]

Preview URLs

• /en-US/docs/Learn_web_development/Extensions/Server-side/Express_Nodejs/Displaying_data/Book_detail_page
• /en-US/docs/Learn_web_development/Extensions/Server-side/Express_Nodejs/Displaying_data/Book_list_page

(comment last updated: 2025-03-21 01:39:33)

[Josh-Cena]

This is the demo side fix to #5320

Is the other side of the fix coming up? We should have at least one PR that automatically closes the issue which usually is the content PR.

Also, does escaping the backing string do more things than preventing HTML injection? Does it also prevent SQL injection, considering we aren't even writing raw SQL? If its only goal is to prevent HTML injection, then that should be done in the templating layer, because as you have realized the current way already causes bugs with re-updating.

[hamishwillee]

Yeah - #38675

I linked in the middle at #5320

[Josh-Cena]

Oh yeah see it now: mdn/express-locallibrary-tutorial#305 the PR description put me off for a sec (it should be "content side" not "demo side"). I'm linking the issue to this PR.

[pepelsbey]

Looks like a reasonable solution to me. Thank you :)