NAME¶
HTML::Mason::Escapes - Functions to escape text for Mason
VERSION¶
version 1.54
DESCRIPTION¶
This module contains functions for implementing Mason's substitution escaping
feature. These functions may also be called directly.
- html_entities_escape
- This function takes a scalar reference and HTML-escapes it using the
"HTML::Entities" module. By default, this module assumes that
the string it is escaping is in ISO-8859-1 (pre Perl 5.8.0) or UTF-8 (Perl
5.8.0 onwards). If this is not the case for your data, you will want to
override this escape to do the right thing for your encoding. See the
section on User-defined Escapes in the Developer's Manual for more details
on how to do this.
- url_escape
- This takes a scalar reference and replaces any text it contains matching
"[^a-zA-Z0-9_.-]" with the URL-escaped equivalent, a percent
sign (%) followed by the hexadecimal number of that character.
- basic_html_escape
- This function takes a scalar reference and HTML-escapes it, escaping the
following characters: '&', '>', '<', and '"'.
It is provided for those who wish to use it to replace (or supplement) the
existing 'h' escape flag, via the Interpreter's "set_escape()"
method.
This function is provided in order to allow people to return the HTML
escaping behavior in 1.0x. However, this behavior presents a potential
security risk of allowing cross-site scripting attacks. HTML escaping
should always be done based on the character set a page is in. Merely
escaping the four characters mentioned above is not sufficient. The quick
summary of why is that for some character sets, characters other than
'<' may be interpreted as a "less than" sign, meaning that
just filtering '<' and '>' will not stop all cross-site scripting
attacks. See http://www.megasecurity.org/Info/cross-site_scripting.txt for
more details.
SEE ALSO¶
Mason
AUTHORS¶
- •
- Jonathan Swartz <swartz@pobox.com>
- •
- Dave Rolsky <autarch@urth.org>
- •
- Ken Williams <ken@mathforum.org>
COPYRIGHT AND LICENSE¶
This software is copyright (c) 2012 by Jonathan Swartz.
This is free software; you can redistribute it and/or modify it under the same
terms as the Perl 5 programming language system itself.