in reply to Back to acceptable untainted characters

There are no dangerous characters. You've managed to miss the point of not trusting user input, which is don't do dangerous things with user input, and if you do, be very careful (ie, don't trust it). If you're storing text users submit via a form, let them submit whatever they want, but don't try to eval it.
  • Comment on Re: Back to acceptable untainted characters

Replies are listed 'Best First'.
Re: Re: Back to acceptable untainted characters
by bradcathey (Prior) on Sep 07, 2003 at 02:39 UTC
    Ahhh, so it's ME I need to watch, and not so much the user? Good point. Thanks. BTW, I am escaping the single ' for MySQL use, for obvious reasons.
[reply]
[reply]
        I'm honored merlyn. I've read and read about your terse replies, and now I'm the proud owner of one. But seriously, thanks for the admonition. I haven't been consistent about using placeholders, but I'm becoming a reformed coder. Once I started hanging around the monastery, I knew that if I paid attention to the superiors, my code would grow up.
[reply]
        Placeholders? 
         ___
/\__\ "What is the world coming to?"
\/__/ www.wolispace.com

        [download]
[reply]
[d/l]
Re: Re: Back to acceptable untainted characters
by Jeppe (Monk) on Sep 08, 2003 at 11:12 UTC
    I have to disagree.

    For the integrity of your own server, you are (I believe) correct. But if someone evil submits code that breaks into the browser of whoever is reading the text, that one with the compromized system will not be pleased (s)he used your solution.

    So, please strip scripts as a bare minimum.

[reply]

In Section Seekers of Perl Wisdom