确保 HTML 和 URL 编码的技术
有没有人实现了一个好的系统来确保输出在有意义的情况下正确地进行 HTML 编码？也许甚至可以识别输出何时应采用 URL 编码或 JSON 编码？
当您想要将这些输入发送到数据库或 JavaScript 代码块时，惰性方法（仅对所有输入进行编码）会导致问题。所以需要一些更聪明的东西。
这种乏味的方法——在模板上的每条数据周围放置适当的编码函数——是有效的，但开发人员很容易忘记这样做。
是否有一种好的方法可以让开发人员变得轻松，并确保完成正确的编码？我正在听一个 SO 播客，Joel 提出了一个关于使用类型化数据来强制区分 HTML 编码字符串和非编码字符串的想法。也许这可以作为一个起点。
我更多地寻找一种策略，而不是特定语言的实现（尽管我很高兴听到已经存在且有效的实现）。
编辑：以下是我迄今为止找到的一些链接：
Has anyone implemented a good system for ensuring that output is properly HTML-encoded where it makes sense? Maybe even something that recognizes when output should be URL-encoded or JSON-encoded instead?
The lazy approach — just encoding all inputs — causes problems when you want to send those inputs to a database, or to a block of JavaScript code. So something a little smarter is needed.
The tedious approach — putting the proper encoding function around each piece of data on the template — works, but it's easy for developers to forget to do it.
Is there a good approach that makes it easy for developers, and ensures that the right encoding is done? I was listening to one of the SO podcasts, and Joel tossed out an idea about using typed data to enforce a difference between HTML-encoded strings and non-encoded strings. Maybe that could be a starting point.
I'm looking more for a strategy than for an implementation in a particular language (although I'd be happy to hear about implementations that already exist and work).
EDIT: Here are some links I've found so far:
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
进入数据库的数据可能不应该有任何 HTML、JavaScript 或其他内容的转义。如果您确实包含标记，如果您决定将此数据注入 CSV 文件或 PDF 等，则只需将其删除...
相反，每当您查询“原始”数据时，例如将其从数据库中取出，将当时的数据转义到您将其注入的任何位置； HTML、JavaScript 字符串、服务器端脚本等。
Data that goes into your database probably should not have any escaping for HTML, JavaScript, or what have you. If you do include markup, you'll just have to strip it out if you decide to inject this data into a CSV file or PDF, etc...
Instead, whenever you query 'raw' data like this out of the database, escape the data at that time as appropriate to wherever you're injecting it; HTML, a JavaScript string, server-side scripting, etc.