Beefy Boxes and Bandwidth Generously Provided by pair Networks
Keep It Simple, Stupid
 
PerlMonks  

Re: Best Module for Cross-Site Scripting ?

by duelafn (Vicar)
on Aug 19, 2010 at 12:36 UTC ( #856017=note: print w/replies, xml ) Need Help??


in reply to Best Module for Cross-Site Scripting ?

The one time I actually needed to accept (and filter) HTML I used HTML::Scrubber and found it to be nice. However, all other times I simply use encode_entities($input, '<>&"'); from HTML::Entities (or an equivalent speedier sub).

Good Day,
    Dean

Replies are listed 'Best First'.
Re^2: Best Module for Cross-Site Scripting ?
by larryl (Scribe) on Aug 19, 2010 at 18:41 UTC

    I have also had very good experience with HTML::Scrubber. I use it entirely in "whitelist mode", so only the tags I want come through, and for those tags, only the attributes I want on them come through.

    One small drawback is that it does not check for the HTML being well-formed, e.g. if you send it HTML snippets with missing closing tags, those will come through as-is.

    Larry

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://856017]
help
Chatterbox?
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others perusing the Monastery: (None)
    As of 2017-07-27 00:45 GMT
    Sections?
    Information?
    Find Nodes?
    Leftovers?
      Voting Booth?
      I came, I saw, I ...
























      Results (402 votes). Check out past polls.