From cc6a9d494d77ff910064d17719848445c05642ee Mon Sep 17 00:00:00 2001
From: Jeremy Ashkenas <jashkenas@gmail.com>
Date: Wed, 5 Oct 2011 16:19:00 -0400
Subject: [PATCH] Merging in escaping for Underscore templates, using <%-
 syntax. Sorry Eco.

---
 test/utility.js | 4 ++++
 underscore.js   | 6 +++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/test/utility.js b/test/utility.js
index 58368a13e..976b3b996 100644
--- a/test/utility.js
+++ b/test/utility.js
@@ -81,6 +81,10 @@ $(document).ready(function() {
     var withNewlinesAndTabs = _.template('This\n\t\tis: <%= x %>.\n\tok.\nend.');
     equals(withNewlinesAndTabs({x: 'that'}), 'This\n\t\tis: that.\n\tok.\nend.');
 
+    var template = _.template("<i><%- value %></i>");
+    var result = template({value: "<script>"});
+    equals(result, '<i>&lt;script&gt;</i>');
+
     if (!$.browser.msie) {
       var fromHTML = _.template($('#template').html());
       equals(fromHTML({data : 12345}).replace(/\s/g, ''), '<li>24690</li>');
diff --git a/underscore.js b/underscore.js
index 1b2058f82..913278837 100644
--- a/underscore.js
+++ b/underscore.js
@@ -816,7 +816,7 @@
     for (var i = 0; i < n; i++) iterator.call(context, i);
   };
 
-  // Escape string for HTML
+  // Escape a string for HTML interpolation.
   _.escape = function(string) {
     return (''+string).replace(/&(?!\w+;|#\d+;|#x[\da-f]+;)/gi, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/\//g,'&#x2F;');
   };
@@ -842,7 +842,7 @@
   _.templateSettings = {
     evaluate    : /<%([\s\S]+?)%>/g,
     interpolate : /<%=([\s\S]+?)%>/g,
-    encode      : /<%==([\s\S]+?)%>/g
+    escape      : /<%-([\s\S]+?)%>/g
   };
 
   // JavaScript micro-templating, similar to John Resig's implementation.
@@ -854,7 +854,7 @@
       'with(obj||{}){__p.push(\'' +
       str.replace(/\\/g, '\\\\')
          .replace(/'/g, "\\'")
-         .replace(c.encode, function(match, code) {
+         .replace(c.escape, function(match, code) {
            return "',_.escape(" + code.replace(/\\'/g, "'") + "),'";
          })
          .replace(c.interpolate, function(match, code) {