[11481] in www-talk@info.cern.ch

home help back first fref pref prev next nref lref last post

Re: HTML Security Issue

daemon@ATHENA.MIT.EDU (Jeff Sinclair)
Fri Feb 11 04:17:39 2000

Message-Id: <3.0.5.32.20000211171645.00a1dd70@melb1>
Date: Fri, 11 Feb 2000 17:16:45
To: www-talk@w3c.org
From: Jeff Sinclair <jeffs@kestral.com.au>
In-Reply-To: <38A3CB32.402532D3@stud.umist.ac.uk>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Resent-From: www-talk@w3.org

Hi Edward,

Nice Idea but what if the user put's in "&amp" 
you can't tell the difference between that and what came 
out of the database. So if you convert it when going into the
database you get "&amp;amp" and then "&amp;amp;amp" etc 

Jeff Sinclair

>
>Why not also convert '&' characyters entered by the user into '&amp;'
>entities, then when it is reconverted, a '<' will be a '<' and a '&lt;'
>will be '&lt;'
>
home help back first fref pref prev next nref lref last post