[11486] in www-talk@info.cern.ch
Re: HTML Security Issue
daemon@ATHENA.MIT.EDU (Jeff Sinclair)
Tue Feb 15 20:36:59 2000
Message-Id: <3.0.5.32.20000216093548.01c6b620@melb1>
Date: Wed, 16 Feb 2000 09:35:48
To: www-talk@w3c.org
From: Jeff Sinclair <jeffs@kestral.com.au>
In-Reply-To: <Pine.SOL.3.96.1000211105201.24940B-100000@bacon.math.uwate
rloo.ca>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Resent-From: www-talk@w3.org
Hi,
the Problem is that the edit box does it's own conversion.
When a user put's " < " into an edit box, if you just
put it back the same into the edit box it will show as " < ",
so you encode it as " &lt; " and then it show's as
" < " exactly as the user typed it, fine.
When the user now submits the form again it, if you get
" &lt; " you can not tell if the user
did nothing or if the user manually changed it to " &lt; "
in the first case you don't want to reconvert it in the second
you do.
example
<input type="text" size=60 maxlength=60 name="title" value=" < ">
shows as "<";
Edit Boxes should not do any coversion and just show what
is in the string.
Jeff Sinclair
At 10:53 11/02/2000 -0500, you wrote:
>On Fri, 11 Feb 2000, Jeff Sinclair wrote:
>
>> Hi Edward,
>>
>> Nice Idea but what if the user put's in "&"
>> you can't tell the difference between that and what came
>> out of the database. So if you convert it when going into the
>> database you get "&amp" and then "&amp;amp" etc
>
>Um, isn't the the behaviour you want? Just keep tabs on whether it is
>encoded or not. It's kinda like dealing with URIs.
>
>--
>Russell O'Connor roconnor@uwaterloo.ca
> <http://www.undergrad.math.uwaterloo.ca/~roconnor/>
>``Paradoxically, a refusal to `put a monetary value on life' means that
>life is often undervalued.'' -- Artificial Intelligence: A Modern Approach
>
>
>
