Escape problem

[ketulp_baroda]

Hi
I am developing a web application.
I have a string 'foo"bar"' say in variable s.
When I print s on the python shell it prints correctly 'foo"bar"'
whereas when I try to display s on the form it just prints 'foo'. What
should I do to print complete string 'foo"bar"' on the form

 

[Jeff Epler]

The exact answer depends on what library you're using in your
application.

THe low-level answer is that you must properly escape characters that
would otherwise be treated specially by html.

For example, the output needs to look like this
<FORM ...>
<INPUT TYPE="text" NAME="something" VALUE="foo&quot;bar&quot">
...
</FORM>

If you do not escape or otherwise treat specially the " characters, the
resulting non-html output will contain something like
<INPUT TYPE="text" NAME="something" VALUE="foo"bar"">

.... this kind of bug can also lead to cross-site scripting (XSS) problems,
for instance if an attacker can control the string in question and sets
it to something like '"><SCRIPT>alert(document.cookie)</SCRIPT>'...

Jeff

 

[Terry Reedy]

Hi
I am developing a web application.
I have a string 'foo"bar"' say in variable s.
When I print s on the python shell it prints correctly 'foo"bar"'
whereas when I try to display s on the form it just prints 'foo'. What
should I do to print complete string 'foo"bar"' on the form

If I understand correctly, you are trying to print a string with an
embedded double quote ("), which html interpretes as a metachar rather than
as content. Isn't there an entity reference for the double quote char?
named 'quote' maybe?

tjr

 

[Thomas Guettler]

Am Tue, 02 Mar 2004 06:57:19 -0800 schrieb ketulp_barod:

Hi
I am developing a web application.
I have a string 'foo"bar"' say in variable s.
When I print s on the python shell it prints correctly 'foo"bar"'
whereas when I try to display s on the form it just prints 'foo'. What
should I do to print complete string 'foo"bar"' on the form

Hi,

have a look at the HTML source-code. Does it look right?

If you want to use the value in an attribute,
you need to quote it:

cgi.escape(s, 1)

thomas

 

[ketulp_baroda]

The exact answer depends on what library you're using in your
application.

THe low-level answer is that you must properly escape characters that
would otherwise be treated specially by html.

For example, the output needs to look like this
<FORM ...>
<INPUT TYPE="text" NAME="something" VALUE="foo&quot;bar&quot">
...
</FORM>

If you do not escape or otherwise treat specially the " characters, the
resulting non-html output will contain something like
<INPUT TYPE="text" NAME="something" VALUE="foo"bar"">

... this kind of bug can also lead to cross-site scripting (XSS) problems,
for instance if an attacker can control the string in question and sets
it to something like '"><SCRIPT>alert(document.cookie)</SCRIPT>'...

Jeff

Thanks that solyed my problem