html-encode | 易学教程

To HTMLENCODE or not to HTMLENCODE user input on web form (asp.net vb)

阅读更多关于 To HTMLENCODE or not to HTMLENCODE user input on web form (asp.net vb)

问题 I have many params making up an insert form for example: x.Parameters.AddWithValue("@city", City.Text) I had a failed xss attack on the site this morning, so I am trying to beef up security measures anyway.... Should I be adding my input params like this? x.Parameters.AddWithValue("@city", HttpUtility.HtmlEncode(City.Text)) Is there anything else I should consider to avoid attacks? 回答1: Don't encode input. Do encode output. At some point in the future, you might decide you want to use the

How do I XML-encode a string in Erlang?

阅读更多关于 How do I XML-encode a string in Erlang?

I have a erlang string which may contain characters like & " < and so on: 1> Unenc = "string & \"stuff\" <". ok Is there a Erlang function somewhere that parses the string and encodes all the needed HTML/XML entities, such as: 2> Enc = xmlencode(Unenc). "string & "stuff" <". ? My use case is for relatively short strings, which come from user input. The output strings of the xmlencode function will be the content of XML attributes: <company name="Acme & C." currency="€" /> The final XML will be sent over the wire appropriately. There is a function in the Erlang distribution that escapes angle

Where is HtmlEncode in Asp.NET 5

阅读更多关于 Where is HtmlEncode in Asp.NET 5

I have a custom IHtmlHelper extension method that uses TagBuilder and returns an HtmlString . I can no longer pass tagBuiler.ToString() to the HtmlString constructor as that just returns the typename now. I see I can use the tabBuiler.WriteTo(TextWriter, IHtmlEncoder) method but I don't know exactly how to get my hands on an object that implments IHtmlEncoder . I see encoders in both System.Text.Encodings.Web and Microsoft.Framework.WebEncoders . But the types in the two namespace don't seem to play well together. HtmlEncoder in Microsoft.Extensions.WebEncoders.Core is just a wrapper around

Transmitting newline character “\n”

阅读更多关于 Transmitting newline character “\n”

问题 Given the following URL (working, try it!) https://select-test.wp3.rbsworldpay.com/wcc/purchase?instId=151711&cartId=28524&currency=GBP&amount=1401.49&testMode=100&name=Tom%20Gul&address=24%20House%20Road\nSome Place\nCounty&postcode=TR33%20999&email=email@mail.com&country=GB If you click on the link and go through to the payment page, the address in the address box is not displaying properly, the newline characters are displaying as text. I've tried passing through 's but no luck,

PHP convert foreign characters with accents

阅读更多关于 PHP convert foreign characters with accents

问题 Hi I'm trying to compare some text to the text in a database.. in the database any text with an accent is encoded like in html (ie. é) when I compare the database text to my string it doesn't match because my string just shows é .. when I use the php function htmlentities to encode the string first the é turns into Ã© weird? using htmlspecialchars doesn't encode the é at all.. how would you suggest I compare é to é as well as all the other accented characters? 回答1: You need to send in the

With the new Razor View Engine, should my HtmlHelpers return string or IHtmlString?

阅读更多关于 With the new Razor View Engine, should my HtmlHelpers return string or IHtmlString?

问题 With the Razor View Engine, anytime you output a string directly to the page, it's HTML encoded. e.g.: @"Hello World" will actually get output to the page as: Hello World Which would show up in the browser as: Hello World Here's the problem though, when creating Html helpers, till now, with the old aspx view engine I would just return a string, and output that to the browser: <%= Html.MyCoolHelperMethod(); %> So my question is basically this. Do I do this: public static

Make an NSURL with an encoded plus (%2B)

阅读更多关于 Make an NSURL with an encoded plus (%2B)

I need to pass a timestamp with a timezone offset in a GET request, e.g., 2009-05-04T11:22:00+01:00 This looks like a two arguments "2009-05-04T11:22:00" and "01:00" to the receiving PHP script (over which I've no control). NSURL doesn't encode plus signs, but if I make an NSURL using the string 2009-05-04T11:22:00%2B01:00 the url I end up with contains: 2009-05-04T11:22:00%252B01:00 Any ideas how I can preserve my encoded plus sign or just plain prevent NSURL from encoding anything? anonymous What worked for me was doing the UTF8 conversion, then replacing the + sign with %2B: NSString

With the new Razor View Engine, should my HtmlHelpers return string or IHtmlString?

阅读更多关于 With the new Razor View Engine, should my HtmlHelpers return string or IHtmlString?

With the Razor View Engine, anytime you output a string directly to the page, it's HTML encoded. e.g.: @"Hello World" will actually get output to the page as: Hello World Which would show up in the browser as: Hello World Here's the problem though, when creating Html helpers, till now, with the old aspx view engine I would just return a string, and output that to the browser: <%= Html.MyCoolHelperMethod(); %> So my question is basically this. Do I do this: public static IHtmlString MyCoolHelperMethod(this HtmlHelper helper) { return new helper.Raw("Hello World");

HTML.Encode but preserve line breaks

阅读更多关于 HTML.Encode but preserve line breaks

I take user input into a text area, store it and eventually display it back to the user. In my View (Razor) I want to do something like this... @Message.Replace("\n", "") This doesn't work because Razor Html Encodes by default. This is great but I want my line breaks. If I do this I get opened up to XSS problems. @Html.Raw(Message.Replace("\n", "")) What's the right way to handle this situation? Richard Schneider Use HttpUtility.HtmlEncode then do the replace. @Html.Raw(HttpUtility.HtmlEncode(Message).Replace("\n", " ")) If you find yourself using this more than once it may be

HTML Encoded strings recognized by the javascript engine, how's it possible?

阅读更多关于 HTML Encoded strings recognized by the javascript engine, how's it possible?

问题 Well. This night was a very strange night to me. I am sorry to create a new question after creating two other questions previously, but this is another argument at all. If I get an answer here, I'll get an answer to those questions too so please somebody listen to me and try to understand. It all began with a simple script JS to be generated through an aspx codebehind file. On a control, I had to put a JavaScript in this way: this.MyTxtBox.Attributes["onfocus"] = "windows.alert('Hello World!'