it really depends on what you are going for... i wouldn't use it all the time, and i can think of and instance specifically where i wouldn't: suppose you built a content manager for a client and you want them to be able to use javascript... then obviously you wouldn't want to strip out the <script> tags.
a case where you might want to strip out style tags and inline style= attributes (which the udf probably overlooks) is on a message board. If someone where to use a style setting to make a big blue div that covered 100% of the screen, and make it look like windows' blue screen of death, obviously you don't want to allow that. or if they made the font size 1000pt so that no one could read anything...
in your case, it sounds like you aren't looking for data that has html or anything in it, so it would be best to strip out all html, javascript, etc.
Crazee does make a good point with his example.. you obviously don't want that to happen. in my experience however, CF has always automatically escaped single quotes for just that same reason... and they have a function (preservesinglequotes) which will override and make it so that the single quotes aren't escaped. still, its considered best practice to use the <cfQueryParam>...
ultimately, you'll have to make the decision on what you need for data and what you don't, and it seems like that udf just makes taking out the stuff you don't want that much easier.
Main Topics
Browse All Topics
by: CrazeePosted on 2003-08-06 at 19:34:14ID: 9096437
Supposing that you have a simple scenario, where you want to limi your search to certain keywords...
So you have SQL statement:
SELECT sth FROM someTable WHERE someData = 'aString'
aString is your parameter. You expect user to enter a string of characters into your search text field...
Howether if user would enter for example:
string' OR 0=0
He would get all the records displayed.
This is not harmful but gives you an idea...
So you want to disallow user from entering quotes ( best allow only characters and digits )
Suppose the user wants to enter description for sth.
If you allow the use of <script> tag, the user could use it and enter the harmful javascript code between these tags.
Next time the entered data would be displayed on the page, the script would run and cause trouble...
So you want to use your SafeText every time you enter the date into the database, save to file, etc.
It is good practice to use <cfQueryParam> tag in your SQL statement, this way you can specify the type of data the user should enter...how ever, the strig is still a string.
cheers...