Re: Html_Safe: excluded id/name attributes

Thanks for the quick response, Brett. Brett Bieber schrieb:

Um... let's see. User could submit something with an id which is the same as a selector in your CSS which could mess up the site visually.

Ok, that's a point.

--- also would break validation.

His site does not validate anyway ;) Well, no, that's not that much a problem in this case.

This also could cause problems if you use javascript and getElementById('foo') and there are two id='foo' on the same page.

There's some javascript, yes. Mostly eyecandy, form validation etc. Nothing, the serverside would rely on, I think.

The name attribute could cause problems within forms if names collide, or named anchors for bookmarks http://example.com/#foo Those are a couple examples.

Hmmm ... yes. Am I right to sum that up to "users could defunct the page they've submitted their html to"?

If you don't use id's in css selectors, javascript with getElementById(), named anchors, or the html won't be displayed within a <form></form> then you shouldn't have too much to worry about - as long as id's don't collide and/or you don't care about w3 validation.

They use ids in css, js and named anchors. The html is re-displayed as values of form elements, but I think it's escaped by htmlentities() or something.

I'm sure there are other potential problems, those are a couple I could think of. It think stripping the name and id is a good idea.

It prevents people from building small TOCs with named anchors for long texts etc. I think my customer worries about things like xss, csrf attacks and the like. Stuff that would allow hijacking an admins account or so. That's why they use Html_Safe to strip javascript and css at least. Because it's some sort of business intranet app people won't mess their pages up visually (at least not intentionally ;). Thanks again for the answers! -- Sven