AW: HTML encoder

Hi Phil,

The most secure way is using Seaside's canvas:
WAHtmlCanvas builder render:[:r | r text: myString]

If you want to use the encoded string as part of other HTML, don't! Instead generate your HTML using Seaside's canvas. Correctly encoding in HTML is damn difficult and there's a difference if your string is used as attribute value (<a attr="foo">) or as text between elements (<a>foo</a>). If you want to be save, use the canvas!

Alternatively you can use XML.Text (e.g. XML.Text text:'<abc>'), its printString will be correct xml (it'll not use HTML entities though).

Kind Regards
Karsten
Von: Philippe Demaecker [mailto:[email protected]]
Gesendet: Mittwoch, 12. Januar 2022 12:15
An: [email protected]
Betreff: [vwnc] HTML encoder

Hi list,

I'm looking for a piece of code that will convert a string to its HTML encoded equivalent.

Input: <script>alert(1)</script>
Ouput: &lt;script&gt;alert&lpar;1&rpar;&lt;&sol;script&gt;

(Or: https://urldefense.com/v3/__https://gchq.github.io/CyberChef/*recipe=To_HTML_Entity(false,'Named*20entities')&input=PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg__;IyU!!DZ3fjg!sNV_QeSwISjjvLaF0l8JAQVk6iVMbUocyiWY6dfXTXil5cV0uqW3ngrA6lu2tXFjbgOu08k$ <https://urldefense.com/v3/__https:/gchq.github.io/CyberChef/*recipe=To_HTML_Entity(false,'Named*20entities')&input=PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg__;IyU!!DZ3fjg!u449TzBNRX-iDgMuIVq_ZiHgLMU3o2OLQSszE_VyPPrTzx72g5mbpe0JIfRqtNoq2fr3ME0$>)

I searched the code and list, but no luck.

Any ideas?

Thanks,
Phil