GSP
Quick Navigator

Search Site

Unix VPS
A - Starter
B - Basic
C - Preferred
D - Commercial
MPS - Dedicated
Previous VPSs
* Sign Up! *

Support
Contact Us
Online Help
Handbooks
Domain Status
Man Pages

FAQ
Virtual Servers
Pricing
Billing
Technical

Network
Facilities
Connectivity
Topology Map

Miscellaneous
Server Agreement
Year 2038
Credits
 

USA Flag

 

 

Man Pages


Manual Reference Pages  -  HTML::MASON::ESCAPES (3)

.ds Aq ’

NAME

HTML::Mason::Escapes - Functions to escape text for Mason

CONTENTS

DESCRIPTION

This module contains functions for implementing Mason’s substitution escaping feature. These functions may also be called directly.
html_entities_escape This function takes a scalar reference and HTML-escapes it using the HTML::Entities module. By default, this module assumes that the string it is escaping is in ISO-8859-1 (pre Perl 5.8.0) or UTF-8 (Perl 5.8.0 onwards). If this is not the case for your data, you will want to override this escape to do the right thing for your encoding. See the section on User-defined Escapes in the Developer’s Manual for more details on how to do this.
url_escape This takes a scalar reference and replaces any text it contains matching [^a-zA-Z0-9_.-] with the URL-escaped equivalent, a percent sign (%) followed by the hexadecimal number of that character.
basic_html_escape This function takes a scalar reference and HTML-escapes it, escaping the following characters: ’&’, ’>’, ’<’, and ’"’.

It is provided for those who wish to use it to replace (or supplement) the existing ’h’ escape flag, via the Interpreter’s set_escape() method.

This function is provided in order to allow people to return the HTML escaping behavior in 1.0x. However, this behavior presents a potential security risk of allowing cross-site scripting attacks. HTML escaping should always be done based on the character set a page is in. Merely escaping the four characters mentioned above is not sufficient. The quick summary of why is that for some character sets, characters other than ’<’ may be interpreted as a less than sign, meaning that just filtering ’<’ and ’>’ will not stop all cross-site scripting attacks. See http://www.megasecurity.org/Info/cross-site_scripting.txt for more details.

Search for    or go to Top of page |  Section 3 |  Main Index


perl v5.20.3 HTML::MASON::ESCAPES (3) 2014-11-15

Powered by GSP Visit the GSP FreeBSD Man Page Interface.
Output converted with manServer 1.07.