* Jonathan Rockway <[email protected]> [2008-12-22 22:00]:
>   my $data = Encode::decode('utf8', $raw_data);
>   process($data);
>   print Encode::encode('utf8', $data);

Use `UTF-8`, not `utf8`. The lowercase non-dash version will
perform purely the integer representation conversion but will
not do any validity checks, such as whether an octet sequence
actually decodes to a valid codepoint or if it is even well-
formed, so it could be used to hide XSS or other injection
attacks.

It’s annoying that Perl makes the lazy choice the wrong one.

Regards,
-- 
Aristotle Pagaltzis // <http://plasmasturm.org/>

_______________________________________________
List: [email protected]
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/[email protected]/
Dev site: http://dev.catalyst.perl.org/

Reply via email to