开发者

Sanitize input for code blog

I have a code blog in whi开发者_开发百科ch I have a user input form for submissions. Whatever goes in that form will appear on one of the pages. Now this is a coding blog, so I don't want to strip any HTML tags or javascript code from the input, but I don't want it to executed at any point. What is the best way to render any input harmless? Is replacing < by &lt; and > by &gt; enough?

(for info, the sever will be GAE, the input will be passed around (but never evaluated) in python variables, and stored in a TextProperty)


Yes, replacing < and > should be enough


The best bet would be to simply escape those values on the back-end for safe input into your storage engine and output them using HTML entities so that they are displayed as code.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜