Re: Resources for multi-byte character security?

On Thu, 2024-08-01 at 13:56 -0700, Tex wrote: > Nick see > https://www.unicode.org/reports/tr36/ > Unicode Security Considerations > > and > >  https://unicode.org/reports/tr39/ > Unicode Security Mechanisms > Tex Thank you. I read through the Unicode Security Considerations (tr36) last night and will read the second one later. I made a list of questions as I read: 1. If we want to use UTF-8 as the encoding through the entire application flow, which settings need to be set, and where? There are several encoding settings in PHP, mb* encoding settings, several places in HTML where you can put a charset (meta head, server headers, forms), and the default for HTML5 is supposed to be UTF-8 anyway. Some of these settings seem redundant. 2. Assuming the HTML is setup correctly, is the browser responsible for input encoding? ie. if a user submits a textarea element as part of an HTML form that has Windows-1252 pasted in from MS Word with curly quotes, is it the browser's job to convert the Windows-1252 to UTF-8 on paste and only send UTF-8 to the server, so, theoretically, we shouldn't have to deal with anything other than UTF-8 in our application if we set the options correctly in the HTML?