asked on

escape HTML literals to be sure there are no executable script hack attempts

Hi Experts,

Let's say I'm outputting something that I've taken input for previously. It's possible that someone tried to place executable javascript in that input field. I want to write a function that ensures a literal will not execute by escaping out the relevant characters.

Is there a standard way to do this? What's the best way?

Thanks,
Mike

SOLUTION

Big Monty

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

sudheeshthegreat

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER CERTIFIED SOLUTION

COBOLdinosaur

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

Dave Baldwin

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

COBOLdinosaur

A lot of the client side helper stuff can be implemented automatically in HTML5, all we need now is to wait for the older browser to phase out and we can get rid of almost all the form related scripting.

Cd&

thready

ASKER

Thanks everyone!

Dave Baldwin

You're welcome. On several sites, I've had to kill the HTML5 crap because it did it wrong for what was needed. 'automatically' usually means that you have fixed all the problems and now it works 'automatically'.

COBOLdinosaur

LOL... when was the last time anything was delivered by any major software vendor without bugs?

Cd&

Dave Baldwin

Oh... yesterday between 4:03 and 4:04 AM... Never. And the biggest bug of all has always been 'them' believing without any evidence that they knew what was needed. As has been said... the nice thing about standards is that there are so many of them to choose from.