Re: HTML Security Issue from Jeff Sinclair on 2000-02-11 (www-talk@w3.org from January to February 2000)

From: Jeff Sinclair <jeffs@kestral.com.au>
Date: Fri, 11 Feb 2000 17:16:45
To: www-talk@w3c.org
Message-Id: <3.0.5.32.20000211171645.00a1dd70@melb1>

Hi Edward,

Nice Idea but what if the user put's in "&amp" 
you can't tell the difference between that and what came 
out of the database. So if you convert it when going into the
database you get "&amp;amp" and then "&amp;amp;amp" etc 

Jeff Sinclair

>
>Why not also convert '&' characyters entered by the user into '&amp;'
>entities, then when it is reconverted, a '<' will be a '<' and a '&lt;'
>will be '&lt;'
>

Received on Friday, 11 February 2000 04:11:30 UTC