[11482] in www-talk@info.cern.ch

home	help	back	first	fref	pref	prev	next	nref	lref	last	post

Re: HTML Security Issue

daemon@ATHENA.MIT.EDU (Russell Steven Shawn O'Connor)
Fri Feb 11 11:01:33 2000

Date: Fri, 11 Feb 2000 10:53:31 -0500 (EST)
From: "Russell Steven Shawn O'Connor" <roconnor@uwaterloo.ca>
To: Jeff Sinclair <jeffs@kestral.com.au>
Cc: www-talk@w3.org
In-Reply-To: <3.0.5.32.20000211171645.00a1dd70@melb1>
Message-Id: <Pine.SOL.3.96.1000211105201.24940B-100000@bacon.math.uwaterloo.ca>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Resent-From: www-talk@w3.org

On Fri, 11 Feb 2000, Jeff Sinclair wrote:

> Hi Edward,
> 
> Nice Idea but what if the user put's in "&amp" 
> you can't tell the difference between that and what came 
> out of the database. So if you convert it when going into the
> database you get "&amp;amp" and then "&amp;amp;amp" etc 

Um, isn't the the behaviour you want?  Just keep tabs on whether it is
encoded or not.  It's kinda like dealing with URIs.

-- 
Russell O'Connor                           roconnor@uwaterloo.ca
       <http://www.undergrad.math.uwaterloo.ca/~roconnor/>
``Paradoxically, a refusal to `put a monetary value on life' means that
life is often undervalued.'' -- Artificial Intelligence: A Modern Approach

home	help	back	first	fref	pref	prev	next	nref	lref	last	post