Hi Lukas,
> However I envision it quickly becomes a hassle when you mix html and
> javascript outputting.
How?
echo $sf_data->get('variable', ESC_METHOD);
ESC_ENTITIES. Applies the PHP function htmlentities. to the value with
ENT_QUOTES.
ESC_JS. Escapes a value to be put into a JavaScript string that is
going to be used as HTML. Useful for escaping things where HTML is
going to be dynamically changed using JavaScript.
ESC_JS_NO_ENTITIES. Escapes a value to be put into a JavaScript string
but does not add entities. This is useful if the value is going to be
displayed using a dialog box (e.g. 'javascript:alert(myString);')
> As such the helpers seem like a better approach
Unfortunately they require thought...
The idea behind the escaping strategy is that you should escape by
default. This avoids human error as much as possible. In the majority
of cases people actually want their variables escaped (although they
may not realise it)
> but I
> have a few ideas in my old framework that seem to be worthwhile to me:
> http://svn.oss.backendmedia.com/modules/module_common.phps
You might want to add a couple of variables to your htmlspecialchars
call - your code at the moment is probably exploitable:
htmlentities($value, ENT_QUOTES, 'UTF-8');
While we're on the subject of security, Chris Shiflett has recently
done a 'Security 2.0' presentation which is available as PDF here:
http://shiflett.org/security-2.0.pdf
Paul
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"symfony developers" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/symfony-devs?hl=en
-~----------~----~----~----~------~----~------~--~---
