Re: Best Module for Cross-Site Scripting ?

The one time I actually needed to accept (and filter) HTML I used HTML::Scrubber and found it to be nice. However, all other times I simply use encode_entities($input, '<>&"'); from HTML::Entities (or an equivalent speedier sub).

Good Day,
Dean

Comment on Re: Best Module for Cross-Site Scripting ? Download Code

Replies are listed 'Best First'.
Re^2: Best Module for Cross-Site Scripting ? by larryl (Monk) on Aug 19, 2010 at 18:41 UTC
I have also had very good experience with HTML::Scrubber. I use it entirely in "whitelist mode", so only the tags I want come through, and for those tags, only the attributes I want on them come through. One small drawback is that it does not check for the HTML being well-formed, e.g. if you send it HTML snippets with missing closing tags, those will come through as-is. Larry	[reply]


We don't bite newbies here... much
	PerlMonks