Re: [RFC] Improve HTML escape
| From: | Yasuo Ohgaki | Date: | Mon, 03 Feb 2014 22:44:05 +0000 |
| Subject: | Re: [RFC] Improve HTML escape | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72154@lists.php.net to get a copy of this message | ||
Hi all,
On Tue, Feb 4, 2014 at 7:37 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> On Tue, Feb 4, 2014 at 7:31 AM, Pádraic Brady <padraic.brady@gmail.com>wrote:
>
>> While I'm dubious about forward slash escaping myself and think it
>> might have been OWASP veering into overkill,
>>
>
> Yes they are. They are very conservative to security.
> For example, they suggest to escape almost all char by applying
> HEX escape for JavaScript string literals.
>
> It may be too much, but I'm sure it's more secure.
>
If anyone interested in PHP implementation of OWASP suggested JavaScript
string literal escape. This is my blog for it.
http://blog.ohgaki.net/javascript-string-escape
It's written in Japanese. You may recognize PHP code and use google
translate or like if you would like to read content.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net