use HTML::Entities;
      print encode_entities("<b>hi</b>");

&lt;b&gt;hi&lt;/b&gt;
[download]

    -- Chip Salzenberg, Free-Floating Agent of Chaos

wouldn't just a simple

foreach (@line){
$_ =~ s/\</\&lt\;/g;
$_ =~ s/\>/\&gt\;/g;
}
[download]

work just as well?

John J Reiser
newrisedesigns.com

Well, if that's what I meant, I probably would have typed something like this:

for (@line) {
    s/</&lt;/g;
    s/>/&gt;/g;
}
[download]

But to answer your question: It's actually less brain drain to use a tested and complete module than to write equivalent code -- especially when the code isn't equivalent at all.... Or were you under the impression that the only dangerous characters for HTML rendering are "<" and ">"?

    -- Chip Salzenberg, Free-Floating Agent of Chaos

My current fav is HTML::TagFilter, it allows you to easily strip all HTML or to allow/disallow certain tags based on innumerable attributes. It's a subclass of HTML::Parser. This is particularly useful if you want to allow certain tags, such as for text formatting.

use HTML::TagFilter;
# This will strip all HTML from whatever you pass it.
my $filter=HTML::TagFilter->new(allow=>{},strip_comments=>1);
#fieldvalue appears magically from somewhere;
$fieldvalue=$filter->filter($fieldvalue);
[download]

-Any sufficiently advanced technology is
indistinguishable from doubletalk.

$parser = HTML::TokeParser->new(\$html_messege);
$wohtml = $parser->get_text("BODY");

Baz,

This kind of thing is very important when using Perl for CGI and certain other applications (use SuperSearch to check up on the -T switch or taintchecking.)

Basically the way to do it is using regexps or one of the various modules listed above. The key is the philosophy with which you approach the problem - the way I think it should be done is that ANYTHING which is not expressly allowed should be forbidden: If, for example, you want to use some entered text for a message book then you should strip ALL characters except A-Z, a-z, 0-9 ,!. and maybe? This heads off just about any kind of problem because no tags such as the potential nasty <javascript> javascript code</javascript> can get through. If in doubt, write some code and post it here and ask for comment, I'm sure that the gods will not be upset.

Hope this helps.

"A nerd is someone who knows the difference between a compiled and an interpreted language, whereas a geek is a person who can explain it cogently to a non-geek over a couple of beers" - Elgon

use HTML::Strip;

my $hs = HTML::Strip->new();

my $clean_text = $hs->parse( $raw_html );
$hs->eof;
[download]