Angel3 Developer Guide
  • README
  • Foreword
  • Tutorial
    • Getting Started
    • Minimal Setup
  • Command Line Interface
    • Setup
  • Templates and Views
    • Server Side Rendered Views
    • JAEL3
      • About
      • Basics
      • Custom Elements
      • Strict Resolution
      • Directive: declare
      • Directive: for-each
      • Directive: extend
      • Directive: if
      • Directive: include
      • Directive: switch
  • Authentication
    • About
    • Strategies
    • Local
  • Databases
    • Object Relational Mapping (ORM)
      • About
      • Basic Functionality
      • Relations
      • Migrations
      • PostgreSQL
    • NoSQL
  • Extensions and Plugins
    • Using Plug-ins
    • Writing a Plugin
  • Under the hood
    • Basic Routing
    • Requests & Responses
    • Request Lifecycle
    • Dependency Injection
    • Middleware
    • Controllers
    • Parsing Request Bodies
    • Serialization
    • Service Basics
    • Testing
    • Error Handling
    • Pattern Matching and Parameter
  • Angel Framework Migration
    • Angel 2.x.x to Angel3
      • Rationale - Why a new Version?
      • Framework Changelog
      • 3.0.0 Migration Guide
    • Angel 1.x.x to 2.x.x
      • Framework Changelog
      • 2.0.0 Migration Guide
  • Packages
    • Authentication
    • CORS
    • Database-Agnostic Relations
    • Configuration
    • Databases
      • ORM
      • MongoDB
      • JSON File-based
      • RethinkDB
    • Templates and Views
      • Jael template engine
      • Mustache Templates
      • compiled_mustache-based engine
      • html_builder-based engine
      • Markdown template engine
      • Using Angel with Angular
    • Hot Reloading
    • Pagination
    • Polling
    • Production Utilities
    • REST Client
    • Reverse Proxy
    • Router
    • Serialization
    • Service Seeder
    • Static Files
    • Security
    • Server-sent Events
    • shelf Integration
    • Task Engine
    • User Agents
    • Validation
    • Websockets
  • Resources
    • Dependency Injection Patterns
    • Example Projects
    • YouTube Tutorials
    • Ecosystem
Powered by GitBook
On this page
  • Interpolation
  • Attributes
  • Attribute Values
  • Quoted Attribute Names
  • Unescaped Attributes

Was this helpful?

  1. Templates and Views
  2. JAEL3

Basics

PreviousAboutNextCustom Elements

Last updated 2 years ago

Was this helpful?

Jael syntax is a superset of HTML. The following is valid both in HTML and Jael:

<!DOCTYPE html>
<html>
  <head>
    <title>Title</title>
  </head>
  <body>
    <h1>Hello!</h1>
  </body>
</html>

However, Jael adds two major changes.

Interpolation

Firstly, text blocks can contain interpolations, which are merely Dart expression contained in double curly braces ({{ }}). The value within the braces, once evaluated will be HTML escaped, to prevent XSS. To achieve unescaped output, append a hyphen (-) to the first brace ({{- }}).

<div>
  {{ user.name }}
</div>

<!-- Do not HTML escape this: -->
<div>
  {{- raw.data.will.not.be('escaped') }}
</div>

Attributes

Secondly, whereas in HTML, the values of attributes can only be strings, Jael allows for their values to be any Dart expression:

<img src=profile.avatar ?? "http://example.com/img/avatars/default.png">
<a class=['btn', 'ban-default', 'btn-lg']>Link</a>
<p style={'color': 'red'}></p>

Attribute Values

Values are handled as such:

  • Maps: Serialized as though they were style attributes.

  • Iterables: Joined by a space, like class attributes.

  • Anything else: toString() is invoked.

Quoted Attribute Names

In case the name of your attribute is not a valid Dart identifier, you can wrap it with quotes, and it will still be processed as per normal:

<button "(click)"="myEventHandler($event)" />

Unescaped Attributes

These will also be HTML escaped; however, you can replace = with != to print unescaped text:

<img src!="<SCARY XSS STRING BEWARE!!!>" />
Basic
Interpolation
Attributes
Attribute Values
Quoted Attribute Names
Unescaped Attributes