Html_Safe: excluded id/name attributes

From: Date: Mon, 03 Apr 2006 01:27:38 +0000
Subject: Html_Safe: excluded id/name attributes
Groups: php.pear.general 
Request: Send a blank email to pear-general+get-23508@lists.php.net to get a copy of this message
Html_Safe strips name and id attributes from HTML by default. I'd like to know the reason for this. What kind of security problem is introduced by allowing id/name attributes in arbitrary HTML (i.e. content submitted by untrusted users)? I need to understand possible issues because I've been asked by a customer to turn this particular setting/behaviour off in his application - so being able to tell him about the consequences would be nice. Thanks in advance :) -- Sven

« previous php.pear.general (#23508) next »