.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man 5.01 (Pod::Simple 3.43)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "HTML::Mason::Escapes 3pm"
.TH HTML::Mason::Escapes 3pm 2024-03-05 "perl v5.38.2" "User Contributed Perl Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
HTML::Mason::Escapes \- Functions to escape text for Mason
.SH DESCRIPTION
.IX Header "DESCRIPTION"
This module contains functions for implementing Mason's substitution
escaping feature.  These
functions may also be called directly.
.IP html_entities_escape 4
.IX Item "html_entities_escape"
This function takes a scalar reference and HTML-escapes it using the
\&\f(CW\*(C`HTML::Entities\*(C'\fR module.  By default, this module assumes that the
string it is escaping is in ISO\-8859\-1 (pre Perl 5.8.0) or UTF\-8 (Perl
5.8.0 onwards).  If this is not the case for your data, you will want
to override this escape to do the right thing for your encoding.  See
the section on User-defined Escapes in the Developer's
Manual for more details on
how to do this.
.IP url_escape 4
.IX Item "url_escape"
This takes a scalar reference and replaces any text it contains
matching \f(CW\*(C`[^a\-zA\-Z0\-9_.\-]\*(C'\fR with the URL-escaped equivalent, a percent
sign (%) followed by the hexadecimal number of that character.
.IP basic_html_escape 4
.IX Item "basic_html_escape"
This function takes a scalar reference and HTML-escapes it, escaping
the following characters: '&', '>', '<', and '"'.
.Sp
It is provided for those who wish to use it to replace (or supplement)
the existing 'h' escape flag, via the Interpreter's \f(CWset_escape()\fR
method.
.Sp
This function is provided in order to allow people to return the HTML
escaping behavior in 1.0x.  However, this behavior presents a
potential security risk of allowing cross-site scripting attacks.
HTML escaping should always be done based on the character set a page
is in.  Merely escaping the four characters mentioned above is not
sufficient.  The quick summary of why is that for some character sets,
characters other than '<' may be interpreted as a "less than" sign,
meaning that just filtering '<' and '>' will not stop all cross-site
scripting attacks.  See
http://www.megasecurity.org/Info/cross\-site_scripting.txt for more
details.