Re: How to set configuration to always using ?html ?

You can't set it in configuration, but you can enclose the body of  
each of your templates into a [#escape x as x?html]...[/#escape] block.

See <http://freemarker.org/docs/ref_directive_escape.html>

There's been some talk about making a feature that'll automatically  
escape all interpolations in all loaded templates. For now, if you  
want it automatically, you can implement your own TemplateLoader that  
inserts the directive tags at the beginning and the end of the loaded  
template content.

Attila.

On 2008.02.20., at 16:36, Newman, John W wrote:

> Hi,
>
> I just found out that I need to always use ?html in html pages!  I  
> entered  <script>alert(‘boo’);</script> on a text field, and got an  
> alert on the next page that output this value!
>
> So I can go through all my web pages search for ${.*} and replace it  
> with ${.*?html}, but isn’t there a simple way to set that in the  
> configuration?  I haven’t been able to find it thus far, any help is  
> appreciated.  Also is there any reason that would not be a good  
> idea, even if I am always rendering html?
>
> Thanks,
> John


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/