> JSStringFormat, XMLFormat, URLEncodedFormat, HTMLCodeFormat, and
> HTMLEditFormat take existing strings and remove any metacharacters
> from them. They sanitize the string - make it "safe" - for the
> specific target environment in which the string will be used. The
> specific metacharacters in question depend on the target environment
> in question - JavaScript, XML, URLs, HTML. I don't think it's a good
> idea for one of these functions to "guess" that I want to remove
> something that isn't a metacharacter when in fact I may not. For
> example, I wouldn't want URLEncodedFormat to remove SQL commands
> embedded in a string, even though I don't generally want SQL commands
> in URLs. It's the programmer's job to deal with those specific cases.
I never recommended that it remove anything. If you put \ in front of /
in a javascript literal, the literal then contains the same / that was
in the string before, it just doesn't break if it happens to be inside a
pair of script tags and has the string </script> in it. So it would
continue to work if you used
<a onclick="alert('#jsstringformat("</script>")#');">
The same way that this would work
<script>alert('#jsstringformat("</script>")#');</script>
It's simply more sanitized than it is given the current behavior.
The comparison to having UrlEncodedFormat remove SQL commands is a
straw man argument in this case, because it's not analogous to what I've
suggested. It might have been analogous if I'd suggested that it should
replace "</script>" with "" -- which is conspicuously not what I
suggested.
I'll concede if anyone can produce an example of a case in which
escaping the string would actually cause a problem. No one in this
thread has done that still that I can tell. You're still arguing against
a simple solution to a problem with no obvious side-effects on the basis
of the fear that there might be some ambiguous problem caused by it that
you can't forsee or articulate... in spite of the fact that the solution
has been tested and proven to work. Doom saying for the sake of doom
saying. Lets stop flying places, 'cause that's not natural, God would
have given us wings if he wanted us to fly.
--
s. isaac dealey ^ new epoch
isn't it time for a change?
ph: 503.236.3691
http://onTap.riaforge.org/blog
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to
date
Get the Free Trial
http://ad.doubleclick.net/clk;160198600;22374440;w
Archive:
http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:295663
Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
