Hello,
I've just been reading up a little on security regarding user input and how to handle html and scripts.
My question is, what if I build my own CMS?
Isn't it inevitable that I'll want to store html code, possibly scripts, and almost certainly apostrophes and special characters, and then display them again.
What's the best way to do this, since I wont want to display the encoded html, but the html itself.
Would it be to encode everything then when I want to actually display the html, decode it, but everywhere else, keep it encoded?
I'm just trying to think of all the scenario's that I could come across when I accept user input where I don't know what they could be typing in.
What if I WANT the user to be able to display html?
Is it possible to decode only some tags but leave all other tags encoded?
...
Go to the complete details ...