Re: [RFC] Improve HTML escape
| From: | Yasuo Ohgaki | Date: | Mon, 03 Feb 2014 22:37:49 +0000 |
| Subject: | Re: [RFC] Improve HTML escape | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72153@lists.php.net to get a copy of this message | ||
Hi Padraic,
On Tue, Feb 4, 2014 at 7:31 AM, Pádraic Brady <padraic.brady@gmail.com>wrote:
> While I'm dubious about forward slash escaping myself and think it
> might have been OWASP veering into overkill,
>
Yes they are. They are very conservative to security.
For example, they suggest to escape almost all char by applying
HEX escape for JavaScript string literals.
It may be too much, but I'm sure it's more secure.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net