There's more than one way to do things | |
PerlMonks |
comment on |
( [id://3333]=superdoc: print w/replies, xml ) | Need Help?? |
I was pointing out the dangers of user-permitted HTML markup many years ago
when I talked about how I was including Barney the Dinosaur into guestbooks
on my home page.
I don't think there's a completely secure solution. tilly wrote a fairly nice strongbox solution that permits very carefully a subset of HTML, but it's more in the "only permitted things allowed" realm than the "look for bad things and prevent them" realm. Given the risk, I'd say this is the right approach. -- Randal L. Schwartz, Perl hacker update: Thanks to mdillon for the link for tilly's node. In reply to •Re: Re: Preventing Cross-site Scripting Attacks
by merlyn
|
|