Hi,

This may be a dumb question, but I haven't been able to find the answer.

I use a custom 2.x.x template set, and noticed the <%escape_html Tag%> added with the 3.0.0 update used in the Luna set.

What does this "escape_html" tag do exactly???

I have no problems with my site not using this tag. Is this something I may need to add throughout my template set??? I dread the thought, but wanted to check to make sure.

Thanks!

It prevent HTML code from bring printed to your pages..

Example:

if I enter the following in the Title:

<p><a href="someurl">My site is a for free services.</a></p>

With out the escape_html tage it will print as:
My site is a for free services.

With the tag it will be:

<p><a href="someurl">My site is a for free services.</a></p>
Regards
KaTaBd

Users plug In - Multi Search And Remote Search plug in - WebRing plug in - Muslims Directory

It is recommended you do as it will prevent any XSS vulnerabilities. See the announcement: http://www.gossamer-threads.com/...orum.cgi?post=281029

Adrian

Thanks for the info guys! Much appreciated.

Adrian,

The link was very helpful, but I have one more question....

My site doesn't use html in my links, so I can easily use this code to prevent vulnerabilities right?

If your directory does not allow html in any link info (eg. link descriptions, reviews, etc) then you can not modify your templates and just add an option to GT::Template to html escape all variables. To do this, edit admin/Links.pm (it's on a different line depending on the version you have installed) in "sub user_page", before it calls GT::Template->parse(...), add the following line:

---

Full URL's like "http://www.sitename.com/pics/234/ won't be escaped will they?

I have over 100+ templates so I'd like to get around hand editing most of them if possible.

Thanks again.

If you enable that GT::Template option, then every variable passed into GT::Template that isn't passed as a reference will get HTML escaped. For GLinks, this pretty much means all variables will be HTML escaped (yes, that includes URLs, but in almost all cases won't break anything).

Adrian