Re: option to turn ESCAPE=HTML on by default
Mark Stosberg <mark-WmyhgDpj2fCHT8/[email protected]>
| Newsgroups | gmane.comp.lang.perl.modules.html-template |
|---|---|
| Message-ID | <[email protected]> |
On 2005-10-14, Roger Burton West <roger-UvLOT2mcgw/[email protected]> wrote: > On Fri, Oct 14, 2005 at 06:49:40PM +0400, Alex Kapranoff wrote: >>* Mark Stosberg <mark-WmyhgDpj2fCHT8/[email protected]> [October 14 2005, 18:37]: >>> I'm curious about what other people think about an option to >>> turn ESCAPE=HTML on default, to protect against cross script scripting >>> practices by default. >>All for it. About 10% of my TMPL_VARS are not escaped. "NOESCAPE=html" >>looks very confusing. Should probably be "ESCAPE=none". You are right. Thanks for the refinement. Mark ------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl