Um... not quite. That is, yes, judicious use of escapeHTML can help to avoid having users enter html code where you just expected them to enter text, and fubar'ing the resulting page. However, what you've said seems to imply that you'd never use escapeHTML on text that you generate yourself.

You really want to apply escapeHTML() to anything that you're sending out as part of an HTML page that you want used "as is". That is, assuming that the original poster is going to put the output of this function and put it into an html page, (instead of, for example, sending it out as the value of a Location: redirect header) he should make sure that he outputs the equivalent of:

  use CGI;
  use URI::Escape;

  # here put code that prints out the page header, etc.

  my $secondurl = 'http://www.myothersite.com/myotherwebapp2/foo.asp?p
+aram=1&param=3';
  my $initialurl = 'http://www.mysite.com/mywebapp1/dosomething?' . 'u
+rl=' . uri_escape($secondurl);
  print '<a href="',
        CGI::escapeHTML($initialurl),
        '">launch mywebapp</a>';

  # code that does that does the page footer

[download]

In fact, I have a few times used something like this when formatting HTML output:

sub queryToHTML
{
  my ($uri, %param) = @_;
  my ($sepchar) = '?';
  if (!%param) { $sepchar = ''; }
  elsif ($uri =~ /\?/) { $sepchar = '&'; }
  return CGI::escapeHTML(
    $uri . $sepchar . 
      join '&', 
        map {uri_escape($_) . '=' . uri_escape($param{$_})}
            keys(%param)
  );
}

[download]

If you can guarantee that your queries are going to and from web frameworks that understand ';' as a separator (like, for example, any vaguely modern CGI.pm), you can replace the references to '&' with ';' - the advantage of doing that is that the output html looks less ugly.

In reply to Re: Re: encoding URLs in URLs by fizbin
in thread encoding URLs in URLs by water

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.