To encode data in a URL, you can call CGI::escapeHTML() directly.
URL escaping is different from HTML escaping.
I think the OP needs a module like
URI::Escape. Observe the following code:
$ perl
use CGI;
use URI::Escape;
my $orig = q{a9: _-;&<tag>'"};
printf "HTML escaped: %s\n", CGI->escapeHTML($orig);
printf "URL escaped: %s\n", uri_escape($orig);
^D
HTML escaped: a9: _-;&<tag>'"
URL escaped: a9%3A%20_-%3B%26%3Ctag%3E'%22
Most mainstream browser can recover from common broken (unescaped) urls -
space seem to be the most common.
But rfc2396 is clear in this regard:
2.4.3. Excluded US-ASCII Characters
Although they are disallowed within the URI syntax, we include here
+ a
description of those US-ASCII characters that have been excluded an
+d
the reasons for their exclusion.
<SNIP>
The space character is excluded because significant spaces may
disappear and insignificant spaces may be introduced when URI are
transcribed or typeset or subjected to the treatment of word-
processing programs. Whitespace is also used to delimit URI in man
+y
contexts.
space = <US-ASCII coded character 20 hexadecimal>
<SNIP>
Data corresponding to excluded characters must be escaped in order
+to
be properly represented within a URI.
Named entities (like those generated
by escapeHTML) are simply names for characters and do not
represent URL escaping.
Test HTML snippet:
<a href="http://google.com/search?q=super search">unescaped space</a>
<a href="http://google.com/search?q=super%20search">escaped space</a>
<a href="http://google.com/search?q=super&search">entity amp</a>
<a href="http://google.com/search?q=super%26search">url-escaped amp</a
+>
Attn. OP:
Passing SQL statements this way is a security hole.
|