HTML::Mason::Escapes(3User Contributed Perl DocumentatiHTML::Mason::Escapes(3)NAMEHTML::Mason::Escapes - Functions to escape text for Mason
VERSION
version 1.54
DESCRIPTION
This module contains functions for implementing Mason's substitution
escaping feature. These functions may also be called directly.
html_entities_escape
This function takes a scalar reference and HTML-escapes it using
the "HTML::Entities" module. By default, this module assumes that
the string it is escaping is in ISO-8859-1 (pre Perl 5.8.0) or
UTF-8 (Perl 5.8.0 onwards). If this is not the case for your data,
you will want to override this escape to do the right thing for
your encoding. See the section on User-defined Escapes in the
Developer's Manual for more details on how to do this.
url_escape
This takes a scalar reference and replaces any text it contains
matching "[^a-zA-Z0-9_.-]" with the URL-escaped equivalent, a
percent sign (%) followed by the hexadecimal number of that
character.
basic_html_escape
This function takes a scalar reference and HTML-escapes it,
escaping the following characters: '&', '>', '<', and '"'.
It is provided for those who wish to use it to replace (or
supplement) the existing 'h' escape flag, via the Interpreter's
"set_escape()" method.
This function is provided in order to allow people to return the
HTML escaping behavior in 1.0x. However, this behavior presents a
potential security risk of allowing cross-site scripting attacks.
HTML escaping should always be done based on the character set a
page is in. Merely escaping the four characters mentioned above is
not sufficient. The quick summary of why is that for some
character sets, characters other than '<' may be interpreted as a
"less than" sign, meaning that just filtering '<' and '>' will not
stop all cross-site scripting attacks. See
http://www.megasecurity.org/Info/cross-site_scripting.txt for more
details.
SEE ALSO
Mason
AUTHORS
· Jonathan Swartz <swartz@pobox.com>
· Dave Rolsky <autarch@urth.org>
· Ken Williams <ken@mathforum.org>
COPYRIGHT AND LICENSE
This software is copyright (c) 2012 by Jonathan Swartz.
This is free software; you can redistribute it and/or modify it under
the same terms as the Perl 5 programming language system itself.
perl v5.18.2 2014-01-19 HTML::Mason::Escapes(3)
