3 ms·
> There's html in your text input? - error out How do you detect HTML? Less-than/greater-than signs? Users are now banned from entering Less-than/greater-than
by duncans 7y ago
> There's html in your text input? - error out
How do you detect HTML? Less-than/greater-than signs? Users are now banned from entering Less-than/greater-than signs?
- hombre_fatal 7y agoI once registered for a forum to ask a question, but they had it configured so new users couldn't submit URLs, probably to deal with spam. Their solution was to reject posts that contained what looked like URLs which means any time you don't put a space after a period, it's probably a URL. Like "That is fine.Pizza is good." -> http://fine.pizza http://fine.pizza detected, post rejected But it gets worse. I had a code block in my post and it was also detecting URLs in my code. `console.log` -> URL detected!
- e12e 7y agoGood point. I guess I'm in agreement with tfa here - if special entities are ok, escape output. I don't think I want to allow a greater than sign in a "first name" field, but it might be perfectly valid in a text field. And if that field is text, not hypertext, escaping output seems sane. Maybe only where html is expected - say in the html part of an email, while the text part just uses a proper encoding.