开发者

Sanitize input for code blog

开发者 https://www.devze.com 2022-12-08 07:53 出处:网络
I have a code blog in whi开发者_开发百科ch I have a user input form for submissions. Whatever goes in that form will appear on one of the pages. Now this is a coding blog, so I don\'t want to strip an

I have a code blog in whi开发者_开发百科ch I have a user input form for submissions. Whatever goes in that form will appear on one of the pages. Now this is a coding blog, so I don't want to strip any HTML tags or javascript code from the input, but I don't want it to executed at any point. What is the best way to render any input harmless? Is replacing < by &lt; and > by &gt; enough?

(for info, the sever will be GAE, the input will be passed around (but never evaluated) in python variables, and stored in a TextProperty)


Yes, replacing < and > should be enough


The best bet would be to simply escape those values on the back-end for safe input into your storage engine and output them using HTML entities so that they are displayed as code.

0

精彩评论

暂无评论...
验证码 换一张
取 消