Convert characters to HTML entities 2

[petey]

Anybody have, or know of, a way to convert characters into HTML entities in Perl? This is not URL escaping (%nn), but rather HTML escaping (&#nnn.

I want to echo user input out to the browser for display, but display it literally, avoiding "payload" code being executed in the user's browser as if it were from of my site.

Such a thing would be useful for stopping cross site scripting (XSS) in it's tracks.

Thanks,
petey

 

[webpager]

Why do you need to output as pure HTML?
Print the user input as a string but only allow A-Z, a-z, punctuation and numbers you will prevent those wily little blighters from hi-jacking your code.

Hope this helps
Keith

If I look like Polar bear, have fur like a Polar Bear and have big feet like a Polar Bear - Why am I so damn cold?

 

[petey]

For the 99.9% of users who are not wily blighters!

I'd like them to see what they entered in full, but not have it execute.

petey

 

[goBoating]

wrap it in <pre></pre> tags??? 'hope this helps

If you are new to Tek-Tips, please use descriptive titles, check the FAQs, and beware the evil typo.

 

[petey]

No dice. PRE tags still allow other tags and such to be rendered.

petey

 

[petey]

I think I could better have stated myself by saying &quot;Numeric character references&quot; rahter than &quot;HTML entities&quot;.

Here's a link about it.

http://www.htmlhelp.com/reference/html40/entities/

Is there a mechanism in Perl that translates a character into a Latin-1 decimal numeric equivalent?

petey

 

[justice41]

If I understand you correctly then the following will work. It replaces each character of a string with its decimal equivalent encoded so that a browser will read it correctly.

$encoded = join '', map { '&#'.ord.';' } split //, $string;

(Ha, I had to use this code to encode '&#38;#' to get it to show up correctly)

jaa

 

[justice41]

You could also do

$string =~ s/(\W)/'&#'.ord($1).';'/eg;

which would only encode 'dangerous' characters.

jaa

 

[petey]

Thanks justice41. This is pretty much exactly what I was looking for.

-petey

 

[Raste]

Does someone know how to escape urls then. (URL Escaping mentioned earlier)?

 

[justice41]

Yes, use the URI::Escape module.

http://www.perldoc.com/perl5.6.1/lib/URI/Escape.html

jaa

 

[Raste]

Thanks