Docs: add note that nl2br does not escape HTML (from Disqus comment b…

…y ft)
tkral · May 28, 2011 · a1cfafc · a1cfafc
1 parent 1987a8f
commit a1cfafc
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/documentation/manual/javaextensions.textile b/documentation/manual/javaextensions.textile
@@ -250,6 +250,10 @@ Replaces new-line characters with HTML **br** tags. Returns: **String**.
 bc. ${"one\ntwo".nl2br()}
 one<br/>two
 
+Note that the output is not HTML-escaped, so that the **br** tag is not escaped in the output. This means that you probably want to use "escape()":#escape for user input:
+
+bc. ${userInput.escape().nl2br()}
+
 
 h3. <a name="raw">raw()</a>