Re^2: Input Validation for Template Toolkit

[dipit]

Hello Corion! Thanks for your response. "attack" can contain values such as [e-mail]. In this case, every input is escaped or encoded but i need to encode only attacking ones like login=<script>...</script> etc. Thats why, i wanted to match the input with keywords and display the template accordingly.

[Corion]

Sure, but then somebody could submit login=<img src="http://evil.example.com/attack.js">, and you would have to catch that too.

And certainly, there are other attacks. I would recommend to escape all data that is user-supplied.