<--previous | contents | next-->

Escaped and Unescaped Substitutions

Now, we can finally give a fairly formal definition of Cubictemp's escaping mechanism. The syntax @!...!@ denotes an escaped substitution:

The syntax $!...!$ denotes an un-escaped substitution. Expressions using this substitution syntax are never escaped.

The process of escaping simply involves converting the following characters to their corresponding HTML escape sequences:

The reason for the presence of the " and ’ characters in the list above may not be obvious at first sight. The " character is included because it can be used to break out of an HTML attribute value string. The ’ character is included because programmers often have to substitute text into Javascript strings when creating dynamic web-pages. A single-quote character can be used to break out of a Javascript string, and inject malicious code.

A simple rule of thumb

What all this amounts to is a simple rule of thumb for avoiding XSS problems - always use the escaped substitution syntax if you can. On those rare occasions when you really need to place HTML in a substitution tag, use the un-escaped syntax, but only after carefully evaluating the application context to make sure that users cannot inject malicious data.


<--previous | contents | next--> (11/16/04)
Cubictemp v0.4 Manual