Practical prototype and part 31: The information in this book is distributed on an "as is" basis, without warranty Although every pre-caution has been taken in the preparation of this work, neither the author(s) nor Apress shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in this work. | 172 CHAPTER 8 OTHER HELPFUL THINGS USEFUL METHODS ON BUILT-INS Figure 8-2. The code doesn t sanitize user input. From a server-side perspective failing to sanitize user input is a huge security risk. From a client-side perspective it s also a monkey wrench in your page design. If we re not allowing HTML in blog comments then we ve got to escape the input so that every character is treated as a literal value see Figure 8-3 function updateLivePreview var commentText comment_text . live_preview .update commentText CHAPTER 8 OTHER HELPFUL THINGS USEFUL METHODS ON BUILT-INS 173 Name Andrew Dupont Comment Never em never em pour salt in your eyes. h6 OH LOOK I VE RUINED THINGS h hxxhx PREVIEW Never em never em pour salt in your eyes. h6 OH LOOK I VE RUINED THINGS h6 hr hr Figure 8-3. Comment preview with escaped HTML String escapeHTML finds characters with special meaning in HTML specifically angle brackets and converts them to their HTML entity equivalents Never em never em pour salt in your eyes. .escapeHTML - Never lt em gt never lt em gt pour salt in your eyes. As you might expect String unescapeHTML does the exact opposite Never lt em gt never lt em gt pour salt in your eyes. .unescapeHTML - Never em never em pour salt in your eyes. So that s one approach we can take. Another would be to ignore anything that looks like HTML rather than display it literally Never em never em pour salt in your eyes. .stripTags - Never never pour salt in your eyes. 174 CHAPTER 8 OTHER HELPFUL THINGS USEFUL METHODS ON BUILT-INS In fact this solution better captures the commenter s original intent. String stripTags removes all HTML from a string leaving behind only plain text see Figure 8-4 . Caution Never ever use client-side sanitization as a replacement for server-side sanitization. Client-side sanitization is trivial to bypass and gives you a false sense of security. Instead decide how .
