head	1.6;
access;
symbols;
locks; strict;
comment	@# @;


1.6
date	2011.06.14.03.41.48;	author TWikiContributor;	state Exp;
branches;
next	1.5;

1.5
date	2010.05.29.14.44.55;	author TWikiContributor;	state Exp;
branches;
next	1.4;

1.4
date	2009.03.30.09.18.22;	author TWikiContributor;	state Exp;
branches;
next	1.3;

1.3
date	2008.01.22.03.21.30;	author TWikiContributor;	state Exp;
branches;
next	1.2;

1.2
date	2007.01.16.04.11.56;	author TWikiContributor;	state Exp;
branches;
next	1.1;

1.1
date	2006.06.25.16.26.28;	author TWikiContributor;	state Exp;
branches;
next	;


desc
@buildrelease
@


1.6
log
@buildrelease
@
text
@%META:TOPICINFO{author="TWikiContributor" date="1308022908" format="1.1" version="6"}%
%META:TOPICPARENT{name="TWikiVariables"}%
#VarENCODE
---+++ ENCODE{"string"} -- encodes a string to HTML entities
   * Encode "special" characters to HTML numeric entities. Encoded characters are:
      * all non-printable ASCII characters below space, except newline (="\n"=) and linefeed (="\r"=)
      * HTML special characters ="<"=, =">"=, ="&"=, single quote (='=) and double quote (="=)
      * TWiki special characters ="%"=, ="["=, ="]"=, ="@@"=, ="_"=, ="*"=, ="="= and ="|"=
   * Syntax: =%<nop>ENCODE{"string"}%=
   * Supported parameters:
     | *Parameter:* | *Description:* | *Default:* |
     | ="string"= | String to encode | required (can be empty) |
     | =type="url"= | Encode special characters for URL parameter use, like a double quote into =%22= | (this is the default) |
     | =type="quotes"= | Escape double quotes with backslashes (=\"=), does not change other characters. This type does not protect against cross-site scripting. | =type="url"= |
     | =type="moderate"= | Encode special characters into HTML entities for moderate cross-site scripting protection: ="<"=, =">"=, single quote (='=) and double quote (="=) are encoded. Useful to allow TWiki variables in comment boxes. | =type="url"= |
     | =type="safe"= | Encode special characters into HTML entities for cross-site scripting protection: ="<"=, =">"=, ="%"=, single quote (='=) and double quote (="=) are encoded. | =type="url"= |
     | =type="entity"= | Encode special characters into HTML entities, like a double quote into =&amp;#034;=. Does *not* encode newline (=\n=) or linefeed (=\r=). | =type="url"= |
     | =type="html"= | Encode special characters into HTML entities. In addition to =type="entity"=, it also encodes space, =\n= and =\r=. Useful to encode text properly in HTML input fields. | =type="url"= |
   * Example: =%<nop>ENCODE{"spaced name"}%= expands to =%ENCODE{"spaced name"}%=
   * __%X% Notes:__
      * Values of HTML input fields should encoded as ="html"=.%BR% Example: =&lt;input type="text" name="address" value="%<nop>ENCODE{ "any text" type="html" }%" /&gt;=
      * Double quotes in strings must be escaped when passed into other TWiki variables.%BR% Example: =%<nop>SEARCH{ "%<nop>ENCODE{ "string with "quotes"" type="quotes" }%" noheader="on" }%=
      * Use =type="moderate"=, =type="safe"= or =type="entity"= to protect user input from URL parameters and external sources against [[http://en.wikipedia.org/wiki/Cross-site_scripting][cross-site scripting]] (XSS). =type="entity"= is the safest mode, but some TWiki applications might not work. =type="safe"= provides a safe middle ground, =type="moderate"= provides only moderate cross-site scripting protection.

   * Related: [[%IF{"'%INCLUDINGTOPIC%'='TWikiVariables'" then="#"}%VarFORMFIELD][FORMFIELD]], [[%IF{"'%INCLUDINGTOPIC%'='TWikiVariables'" then="#"}%VarQUERYPARAMS][QUERYPARAMS]], [[%IF{"'%INCLUDINGTOPIC%'='TWikiVariables'" then="#"}%VarURLPARAM][URLPARAM]]
@


1.5
log
@buildrelease
@
text
@d1 1
a1 1
%META:TOPICINFO{author="TWikiContributor" date="1267946812" format="1.1" version="5"}%
d17 2
a18 2
     | =type="entity"= | Encode special characters into HTML entities, like a double quote into =&amp;#034;=. Does *not* encode newline (=\n=) or linefeed (=\r=). Useful to encode text properly in HTML input fields. | =type="url"= |
     | =type="html"= | As =type="entity"= except it also encodes =\n= and =\r= | =type="url"= |
d21 1
a21 1
      * Values of HTML input fields must be entity encoded.%BR% Example: =&lt;input type="text" name="address" value="%<nop>ENCODE{ "any text" type="entity" }%" /&gt;=
d25 1
a25 1
   * Related: [[%IF{"'%INCLUDINGTOPIC%'='TWikiVariables'" then="#"}%VarURLPARAM][URLPARAM]]
@


1.4
log
@buildrelease
@
text
@d1 1
a1 1
%META:TOPICINFO{author="TWikiContributor" date="1235369572" format="1.1" version="4"}%
d13 5
a17 2
     | =type="safe"= | Encode special characters into HTML entities to avoid XSS exploits: ="<"=, =">"=, ="%"=, single quote (='=) and double quote (="=) | =type="url"= |
     | =type="entity"= | Encode special characters into HTML entities, like a double quote into =&amp;#034;=. Does *not* encode =\n= or =\r=. | =type="url"= |
a18 2
     | =type="quotes"= | Escape double quotes with backslashes (=\"=), does not change other characters | =type="url"= |
     | =type="url"= | Encode special characters for URL parameter use, like a double quote into =%22= | (this is the default) |
d23 1
a23 1
      * Use =type="entity"= or =type="safe"= to protect user input from URL parameters and external sources against cross-site scripting (XSS). =type="entity"= is more aggressive, but some TWiki applications might not work. =type="safe"= provides a safe middle ground.
@


1.3
log
@buildrelease
@
text
@d1 1
a1 1
%META:TOPICINFO{author="TWikiContributor" date="1167874036" format="1.1" version="3"}%
d13 1
d19 4
a22 2
   * __%X% Note:__ Values of HTML input fields must be entity encoded.%BR% Example: =&lt;input type="text" name="address" value="%<nop>ENCODE{ "any text" type="entity" }%" /&gt;=
   * __%X% Note:__ Double quotes in strings must be escaped when passed into other TWiki variables.%BR% Example: =%<nop>SEARCH{ "%<nop>ENCODE{ "string with "quotes"" type="quotes" }%" noheader="on" }%=
a24 1

@


1.2
log
@buildrelease
@
text
@d1 1
a1 1
%META:TOPICINFO{author="TWikiContributor" date="1167874036" format="1.2" version="2"}%
a3 1

d15 1
a15 1
     | =type="quote"= | Escape double quotes with backslashes (=\"=), does not change other characters | =type="url"= |
d21 1
a21 1
   * Related: [[#VarURLPARAM][URLPARAM]]
@


1.1
log
@buildrelease
@
text
@d1 1
a1 1
%META:TOPICINFO{author="TWikiContributor" date="1111929255" format="1.2" version="1"}%
d14 3
a16 1
     | =type="entity"= | Encode special characters into HTML entities, like a double quote into =&amp;#034;= | URL encoding |
d19 3
a21 1
   * __%X% Note:__ Values of HTML input fields must be entity encoded, for example:%BR% =&lt;input type="text" name="address" value="%<nop>ENCODE{ "any text" type="entity" }%" /&gt;=
@
