Документ взят из кэша поисковой машины. Адрес
оригинального документа
: http://dualopt1.cmm.msu.ru/bin/view/TWiki/VarENCODE?cover=print.nat;skin=kubrick.nat%2Cnat%2C%20pattern;sortcol=2;table=1;up=0
Дата изменения: Unknown Дата индексирования: Sat Mar 1 14:41:41 2014 Кодировка: |
"\n"
) and linefeed ("\r"
)
"<"
, ">"
, "&"
, single quote ('
) and double quote ("
)
"%"
, "["
, "]"
, "@"
, "_"
, "*"
, "="
and "|"
%ENCODE{"string"}%
Parameter: | Description: | Default:![]() |
---|---|---|
type="url" | Encode special characters for URL parameter use, like a double quote into %22 | (this is the default) |
type="safe" | Encode special characters into HTML entities to avoid XSS exploits: "<" , ">" , "%" , single quote (' ) and double quote (" ) | type="url" |
type="entity" | Encode special characters into HTML entities, like a double quote into " . Does not encode \n or \r . | type="url" |
type="html" | As type="entity" except it also encodes \n and \r | type="url" |
type="quotes" | Escape double quotes with backslashes (\" ), does not change other characters | type="url" |
"string" | String to encode | required (can be empty) |
%ENCODE{"spaced name"}%
expands to spaced%20name
<input type="text" name="address" value="%ENCODE{ "any text" type="entity" }%" />
%SEARCH{ "%ENCODE{ "string with "quotes"" type="quotes" }%" noheader="on" }%
type="entity"
or type="safe"
to protect user input from URL parameters and external sources against cross-site scripting (XSS). type="entity"
is more aggressive, but some TWiki applications might not work. type="safe"
provides a safe middle ground.