Now, we can finally give a fairly formal definition of Cubictemp's
escaping mechanism. The syntax
@!...!@
denotes an escaped substitution:
The syntax
$!...!$
denotes an un-escaped substitution. Expressions using this substitution
syntax are never escaped.
The process of escaping simply involves converting the following characters to their corresponding HTML escape sequences:
The reason for the presence of the " and characters in the list above may not be obvious at first sight. The " character is included because it can be used to break out of an HTML attribute value string. The character is included because programmers often have to substitute text into Javascript strings when creating dynamic web-pages. A single-quote character can be used to break out of a Javascript string, and inject malicious code.
What all this amounts to is a simple rule of thumb for avoiding XSS problems - always use the escaped substitution syntax if you can. On those rare occasions when you really need to place HTML in a substitution tag, use the un-escaped syntax, but only after carefully evaluating the application context to make sure that users cannot inject malicious data.
<--previous | contents | next--> | (11/16/04) |