1HTML::Mason::Escapes(3)User Contributed Perl DocumentatioHnTML::Mason::Escapes(3)
2
3
4

NAME

6       HTML::Mason::Escapes - Functions to escape text for Mason
7

DESCRIPTION

9       This module contains functions for implementing Mason's substitution
10       escaping feature.  These functions may also be called directly.
11
12       html_entities_escape
13           This function takes a scalar reference and HTML-escapes it using
14           the "HTML::Entities" module.  By default, this module assumes that
15           the string it is escaping is in ISO-8859-1 (pre Perl 5.8.0) or
16           UTF-8 (Perl 5.8.0 onwards).  If this is not the case for your data,
17           you will want to override this escape to do the right thing for
18           your encoding.  See the section on User-defined Escapes in the
19           Developer's Manual for more details on how to do this.
20
21       url_escape
22           This takes a scalar reference and replaces any text it contains
23           matching "[^a-zA-Z0-9_.-]" with the URL-escaped equivalent, a per‐
24           cent sign (%) followed by the hexadecimal number of that character.
25
26       basic_html_escape
27           This function takes a scalar reference and HTML-escapes it, escap‐
28           ing the following characters: '&', '>', '<', and '"'.
29
30           It is provided for those who wish to use it to replace (or supple‐
31           ment) the existing 'h' escape flag, via the Interpreter's
32           "set_escape()" method.
33
34           This function is provided in order to allow people to return the
35           HTML escaping behavior in 1.0x.  However, this behavior presents a
36           potential security risk of allowing cross-site scripting attacks.
37           HTML escaping should always be done based on the character set a
38           page is in.  Merely escaping the four characters mentioned above is
39           not sufficient.  The quick summary of why is that for some charac‐
40           ter sets, characters other than '<' may be interpreted as a "less
41           than" sign, meaning that just filtering '<' and '>' will not stop
42           all cross-site scripting attacks.  See http://www.megasecu‐
43           rity.org/Info/cross-site_scripting.txt for more details.
44
45
46
47perl v5.8.8                       2007-04-17           HTML::Mason::Escapes(3)
Impressum