Re: sanitize all value of Query
Brandon Long <[email protected]> Wed, 5 Oct 2011 15:46:22 -0700
| Newsgroups | gmane.text.clearsilver.general |
|---|---|
| Message-ID | <CAA6MhGsN2BV2yogq0ocphPCNMeOnY_CdMzFBBfS4AvpLNL_1kg@mail.gmail.com> |
--mkeqwCy1hf5A6r72Ca0KhMSz6n48ulDcJ4KpqjN
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
<?cs def:sanitize(param) ?>
<?cs set:param =3D html_escape(param) ?>
<?cs each:sub =3D param ?>
<?cs call:sanitize(sub) ?>
<?cs /each ?>
<?cs /def ?>
<?cs each:param =3D Query ?>
<?cs call:sanitize(param) ?>
<?cs /each ?>
or something like that. Note, you may be better off just using the
right escaping whenever you use a Query variable instead of trying to
sanitize them all up front. You'd be even better off using the
auto-escaping code that's in the unreleased 0.11 code base in the SVN
tree on code.google.com
Brandon
On Tue, Oct 4, 2011 at 8:21 AM, bxxx <[email protected]> wrote:
> Hello,
> I would like sanitize (with function html_escape for exemple) all value o=
f query.
>
> How each recursively to a final value ?
>
> thx
>
>
>
>
>
> ------------------------------------
>
> Yahoo! Groups Links
>
>
>
>
--mkeqwCy1hf5A6r72Ca0KhMSz6n48ulDcJ4KpqjN
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
</head>
<body style="background-color: #fff;">
<span style="display:none"> </span>
<!--~-|**|PrettyHtmlStartT|**|-~-->
<div id="ygrp-mlmsg" style="position:relative;">
<div id="ygrp-msg" style="z-index: 1;">
<!--~-|**|PrettyHtmlEndT|**|-~-->
<div id="ygrp-text" >
<p><?cs def:sanitize(param) ?><br>
<?cs set:param = html_escape(param) ?><br>
<?cs each:sub = param ?><br>
<?cs call:sanitize(sub) ?><br>
<?cs /each ?><br>
<?cs /def ?><br>
<br>
<?cs each:param = Query ?><br>
<?cs call:sanitize(param) ?><br>
<?cs /each ?><br>
<br>
or something like that. Note, you may be better off just using the<br>
right escaping whenever you use a Query variable instead of trying to<br>
sanitize them all up front. You'd be even better off using the<br>
auto-escaping code that's in the unreleased 0.11 code base in the SVN<br>
tree on code.google.com<br>
<br>
Brandon<br>
<br>
On Tue, Oct 4, 2011 at 8:21 AM, bxxx <<a href="mailto:vincebouix%40yahoo.fr">[email protected]</a>> wrote:<br>
> Hello,<br>
> I would like sanitize (with function html_escape for exemple) all value of query.<br>
><br>
> How each recursively to a final value ?<br>
><br>
> thx<br>
><br>
><br>
><br>
><br>
><br>
> ------------------------------------<br>
><br>
> Yahoo! Groups Links<br>
><br>
><br>
><br>
><br>
</p>
</div>
<!--~-|**|PrettyHtmlStart|**|-~-->
<div style="color: #fff; height: 0;">__._,_.___</div>
<div id="ygrp-actbar" style="clear: both; margin-bottom: 10px; white-space: nowrap; color: #666; padding-top: 15px;">
<div>
<a href="mailto:[email protected]?subject=Re%3A%20sanitize%20all%20value%20of%20Query" style="margin-right: 0; padding-right: 0;">
Reply to <span style="font-weight: 700;">sender</span></a> |
<a href="mailto:[email protected]?subject=Re%3A%20sanitize%20all%20value%20of%20Query">
Reply to <span style="font-weight: 700;">group</span></a> |
<a href="http://groups.yahoo.com/group/ClearSilver/post;_ylc=X3oDMTJwZDM0bTEyBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBG1zZ0lkAzE0MTcEc2VjA2Z0cgRzbGsDcnBseQRzdGltZQMxMzE3ODU0Nzg3?act=reply&messageNum=1417">Reply <span style="font-weight: 700;">via web post</span></a> |
<a href="http://groups.yahoo.com/group/ClearSilver/post;_ylc=X3oDMTJlM2YzajZuBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA250cGMEc3RpbWUDMTMxNzg1NDc4Nw--" style="font-weight: 700;">Start a New Topic</a>
</div>
<a href="http://groups.yahoo.com/group/ClearSilver/message/1416;_ylc=X3oDMTM0YjdvdDkyBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBG1zZ0lkAzE0MTcEc2VjA2Z0cgRzbGsDdnRwYwRzdGltZQMxMzE3ODU0Nzg3BHRwY0lkAzE0MTY-">Messages in this topic</a>
(<span style="font-weight: 700;">2</span>)
</div>
<!------- Start Nav Bar ------>
<!-- |**|begin egp html banner|**| -->
<div id="ygrp-vital" style="background-color: #e0ecee; font-family: Verdana; font-size: 10px; margin-bottom: 10px; padding: 10px;">
<span id="vithd" style="font-weight: bold; color: #333; text-transform: uppercase; ">Recent Activity:</span>
<ul style="list-style-type: none; margin: 0; padding: 0; display: inline;">
</ul>
<div style="clear: both; padding-top: 2px; color: #1e66ae;">
<a href="http://groups.yahoo.com/group/ClearSilver;_ylc=X3oDMTJldmkyNW02BF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwN2dGwEc2xrA3ZnaHAEc3RpbWUDMTMxNzg1NDc4Nw--" style="text-decoration: none;">Visit Your Group</a>
</div>
</div>
<div id="ygrp-mkp" style="border: 1px solid #d8d8d8; clear: both; float: left; font-family: Arial; margin: 5px 0 10px 0; padding: 0 10px;">
<div id="hd" style="color: #628c2a; font-size: 85%; font-weight: 700; line-height: 122%; margin: 10px 0;">MARKETPLACE</div>
<div id="ads" style="margin-bottom: 10px;">
<div class="ad" style="color: #628C2A; font-family: Arial; font-weight: 700; padding: 0 0;">
<p><a href="http://global.ard.yahoo.com/SIG=15of44sn9/M=493064.14543979.14562481.13298430/D=groups/S=1707281942:MKP1/Y=YAHOO/EXP=1317861987/L=dc6030ae-efa3-11e0-9e5a-c3bd7011f884/B=dEZUBtBDRqc-/J=1317854787739710/K=xJiMTsF2jiufeCc0S4em1Q/A=6060255/R=0/SIG=1194m4keh/*http://us.toolbar.yahoo.com/?.cpdl=grpj">Stay on top of your group activity without leaving the page you're on - Get the Yahoo! Toolbar now.</a></p> <script language=javascript>
if(window.yzq_d==null)window.yzq_d=new Object();
window.yzq_d['dEZUBtBDRqc-']='&U=13c7257l7%2fN%3ddEZUBtBDRqc-%2fC%3d493064.14543979.14562481.13298430%2fD%3dMKP1%2fB%3d6060255%2fV%3d1';
</script><noscript><img width=1 height=1 alt="" src="http://us.bc.yahoo.com/b?P=dc6030ae-efa3-11e0-9e5a-c3bd7011f884&T=1d5n9ev8d%2fX%3d1317854787%2fE%3d1707281942%2fR%3dgroups%2fK%3d5%2fV%3d2.1%2fW%3dH%2fY%3dYAHOO%2fF%3d4197818795%2fH%3dY29udGVudD0iR287UG9kY2FzdHM7V2lkZ2V0cztGbGlja3I7WWFob29fU2VhcmNoX01hcmtldGluZztGaW5hbmNlO0Jvb2ttYXJrO01lc3NhZ2VfQm9hcmRzO0NhbGVuZGFyO0V2ZW50czsiIGRpc2FibGVzaHVmZmxpbmc9IjEiIHNlcnZlSWQ9ImRjNjAzMGFlLWVmYTMtMTFlMC05ZTVhLWMzYmQ3MDExZjg4NCIgc2l0ZUlkPSI0NDUyNTUxIiB0U3RtcD0iMTMxNzg1NDc4NzcxMTcyNyIg%2fQ%3d-1%2fS%3d1%2fJ%3d9D238962&U=13c7257l7%2fN%3ddEZUBtBDRqc-%2fC%3d493064.14543979.14562481.13298430%2fD%3dMKP1%2fB%3d6060255%2fV%3d1"></noscript><!--QYZ ,;;MKP1;1707281942;2;--> </div>
</div>
</div>
<div id="ft" style="font-family: Arial; font-size: 11px; margin-top: 5px; padding: 0 2px 0 0; clear: both;">
<a href="http://groups.yahoo.com/;_ylc=X3oDMTJkY3BwdGgwBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA2dmcARzdGltZQMxMzE3ODU0Nzg3" style="float: left;"><img src="http://l.yimg.com/a/i/us/yg/logo/us.gif" height="15" width="137" alt="Yahoo! Groups" style="border: 0;"/></a>
<div style="color: #747575; float: right;">Switch to: <a href="mailto:[email protected]?subject=Change Delivery Format: Traditional" style="text-decoration: none;">Text-Only</a>, <a href="mailto:[email protected]?subject=Email Delivery: Digest" class="margin-rt" style="text-decoration: none;">Daily Digest</a> • <a href="mailto:[email protected]?subject=Unsubscribe" style="text-decoration: none;">Unsubscribe</a> • <a href="http://docs.yahoo.com/info/terms/" style="text-decoration: none;">Terms of Use</a></div>
</div>
<!-- |**|end egp html banner|**| -->
</div> <!-- ygrp-msg -->
<!-- Sponsor -->
<!-- |**|begin egp html banner|**| -->
<div id="ygrp-sponsor" style="width:160px; float:right; clear:none; margin:0 0 25px 0; background: #fff;">
<!-- Start Recommendations -->
<div id="ygrp-reco">
</div>
<!-- End Recommendations -->
</div> <!-- |**|end egp html banner|**| -->
<div style="clear:both; color: #FFF; font-size:1px;">.</div>
</div>
<img src="http://geo.yahoo.com/serv?s=97359714/grpId=3564137/grpspId=1707281942/msgId=1417/stime=1317854787/nc1=5741392/nc2=4507179/nc3=3848640" width="1" height="1"> <br>
<div style="color: #fff; height: 0;">__,_._,___</div>
<!--~-|**|PrettyHtmlEnd|**|-~-->
</body>
<!--~-|**|PrettyHtmlStart|**|-~-->
<head>
<style type="text/css">
<!--
#ygrp-mkp {
border: 1px solid #d8d8d8;
font-family: Arial;
margin: 10px 0;
padding: 0 10px;
}
#ygrp-mkp hr {
border: 1px solid #d8d8d8;
}
#ygrp-mkp #hd {
color: #628c2a;
font-size: 85%;
font-weight: 700;
line-height: 122%;
margin: 10px 0;
}
#ygrp-mkp #ads {
margin-bottom: 10px;
}
#ygrp-mkp .ad {
padding: 0 0;
}
#ygrp-mkp .ad p {
margin: 0;
}
#ygrp-mkp .ad a {
color: #0000ff;
text-decoration: none;
}
#ygrp-sponsor #ygrp-lc {
font-family: Arial;
}
#ygrp-sponsor #ygrp-lc #hd {
margin: 10px 0px;
font-weight: 700;
font-size: 78%;
line-height: 122%;
}
#ygrp-sponsor #ygrp-lc .ad {
margin-bottom: 10px;
padding: 0 0;
}
a {
color: #1e66ae;
}
#actions {
font-family: Verdana;
font-size: 11px;
padding: 10px 0;
}
#activity {
background-color: #e0ecee;
float: left;
font-family: Verdana;
font-size: 10px;
padding: 10px;
}
#activity span {
font-weight: 700;
}
#activity span:first-child {
text-transform: uppercase;
}
#activity span a {
color: #5085b6;
text-decoration: none;
}
#activity span span {
color: #ff7900;
}
#activity span .underline {
text-decoration: underline;
}
.attach {
clear: both;
display: table;
font-family: Arial;
font-size: 12px;
padding: 10px 0;
width: 400px;
}
.attach div a {
text-decoration: none;
}
.attach img {
border: none;
padding-right: 5px;
}
.attach label {
display: block;
margin-bottom: 5px;
}
.attach label a {
text-decoration: none;
}
blockquote {
margin: 0 0 0 4px;
}
.bold {
font-family: Arial;
font-size: 13px;
font-weight: 700;
}
.bold a {
text-decoration: none;
}
dd.last p a {
font-family: Verdana;
font-weight: 700;
}
dd.last p span {
margin-right: 10px;
font-family: Verdana;
font-weight: 700;
}
dd.last p span.yshortcuts {
margin-right: 0;
}
div.attach-table div div a {
text-decoration: none;
}
div.attach-table {
width: 400px;
}
div.file-title a, div.file-title a:active, div.file-title a:hover, div.file-title a:visited {
text-decoration: none;
}
div.photo-title a, div.photo-title a:active, div.photo-title a:hover, div.photo-title a:visited {
text-decoration: none;
}
div#ygrp-mlmsg #ygrp-msg p a span.yshortcuts {
font-family: Verdana;
font-size: 10px;
font-weight: normal;
}
.green {
color: #628c2a;
}
.MsoNormal {
margin: 0 0 0 0;
}
o {
font-size: 0;
}
#photos div {
float: left;
width: 72px;
}
#photos div div {
border: 1px solid #666666;
height: 62px;
overflow: hidden;
width: 62px;
}
#photos div label {
color: #666666;
font-size: 10px;
overflow: hidden;
text-align: center;
white-space: nowrap;
width: 64px;
}
#reco-category {
font-size: 77%;
}
#reco-desc {
font-size: 77%;
}
.replbq {
margin: 4px;
}
#ygrp-actbar div a:first-child {
/* border-right: 0px solid #000;*/
margin-right: 2px;
padding-right: 5px;
}
#ygrp-mlmsg {
font-size: 13px;
font-family: Arial, helvetica,clean, sans-serif;
*font-size: small;
*font: x-small;
}
#ygrp-mlmsg table {
font-size: inherit;
font: 100%;
}
#ygrp-mlmsg select, input, textarea {
font: 99% Arial, Helvetica, clean, sans-serif;
}
#ygrp-mlmsg pre, code {
font:115% monospace;
*font-size:100%;
}
#ygrp-mlmsg * {
line-height: 1.22em;
}
#ygrp-mlmsg #logo {
padding-bottom: 10px;
}
#ygrp-mlmsg a {
color: #1E66AE;
}
#ygrp-msg p a {
font-family: Verdana;
}
#ygrp-msg p#attach-count span {
color: #1E66AE;
font-weight: 700;
}
#ygrp-reco #reco-head {
color: #ff7900;
font-weight: 700;
}
#ygrp-reco {
margin-bottom: 20px;
padding: 0px;
}
#ygrp-sponsor #ov li a {
font-size: 130%;
text-decoration: none;
}
#ygrp-sponsor #ov li {
font-size: 77%;
list-style-type: square;
padding: 6px 0;
}
#ygrp-sponsor #ov ul {
margin: 0;
padding: 0 0 0 8px;
}
#ygrp-text {
font-family: Georgia;
}
#ygrp-text p {
margin: 0 0 1em 0;
}
#ygrp-text tt {
font-size: 120%;
}
#ygrp-vital ul li:last-child {
border-right: none !important;
}
-->
</style>
</head>
<!--~-|**|PrettyHtmlEnd|**|-~-->
</html>
<!-- end group email -->
--mkeqwCy1hf5A6r72Ca0KhMSz6n48ulDcJ4KpqjN--