I reviewed character escaping everywhere with the following ideas:
* use a single common function to escape user data: `escape` using `htmlspecialchars`.
* sanitize fields in `index.php` after reading them from datastore and before sending them to templates.
It means no escaping function in Twig templates.
2 reasons:
* it reduces risks of security issue for future user made templates
* more readable templates
* sanitize user configuration fields after loading them.
* fix duplicate IDs - #paging_older, #paging_newer become classes as the paging is displayed twice (top, bottom) in the linklist
* fix duplicate IDs - #paging_privatelinks and #paging_linksperpage become classes
* daily links are now valid (use &)
* name attribute is not used anymore on a tag in link list
* center tag is replaced by CSS in picwall and tag cloud
* action in form tag can't be empty, use # instead
* fixed configure table with CSS instead of cellpadding, border, and valign
* export links are now valid
* remove "size" in input tag
* Fix missing alt attributes for img elements
* tpl/daily: Use HTML entities instead of char escape codes
* tpl/export: fix missing </span> closing tag
* Remove obsolete language attribute on <script> elements
jQuery has been removed from all pages, except those who really require
it (like autocomplete in link edition).
Immediate gain: All pages weight 286 kb LESS ! \o/
Highlighting in search results has also been temporarly removed (and
will be re-implemented).
Shaarli uses light Javascript in its normal operation, and some jQuery
for some features (autocomplete in tags, QR-Code popup...).
jQuery can be slow on small computers. An option has been added in
configuration screen to disable javascript features which are hard on
CPU.
(Note that the Picture Wall is awfully heavy *without* jQuery.)
(Side note: A *LOT* of users want Shaarli to work without javasript at
all, if possible. That's why I try to use as few javascript as possible:
It keeps Shaarli pages fast.)
