在 Perl 和 Catalyst 中从用户输入中删除 HTML
我正在为我的 Perl Web 应用程序使用 Catalyst。从用户输入中删除 HTML 的可接受方法是什么？
目前我倾向于使用 HTML::FormatText。但令我感到奇怪的是，我找不到 Catalyst 中内置的实用程序来完成这项常见任务。难道是我刚刚没发现？另外，这些用于删除输入的模块似乎需要 5 行代码。我希望有一个简单的“deHTMLify()”方法。我想我可以自己动手，但不想重新发明轮子。
我认为像 HTML::FormFU 这样的表单验证模块可以为您做到这一点，但我希望避免这种复杂性。我的表格简短而简单。这个决定是不是错了？
我做对了吗？
I'm using Catalyst for my Perl web app. What is the accepted way of removing HTML from user input?
Currently I'm leaning towards using HTML::FormatText. But it seems strange to me that I can't find a utility built into Catalyst to do this common task. Have I just not found it? Also, it seems these modules for removing input take like 5 lines of code. I was hoping for a simple "deHTMLify()" method. I guess I can roll my own but didn't want to reinvent the wheel.
I think the form validation modules like HTML::FormFU do this for you, but I am hoping to avoid that complexity. My forms are short and simple. Is this decision wrong headed?
Am I doing it right?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我认为你做得不对。正确的方法是接受从服务器发送的文本。然后使用
html处理从数据库接收的所有值，或您视图中的html_entities过滤器（可能是TT）。为什么这是正确的方法？好吧，如果您现在不想支持 HTML，您仍然可以破解过滤器，使 HTML 的子集稍后可以工作。这也让用户可以看到他们的输入——只是转义了——而不是将其剥离，从而失去对他们发送的内容和一些潜在有价值的信息的跟踪。你的方式似乎还对输出机制（HTML）做出了一些假设，我对此感到不舒服。为什么您只想对一种输出格式的输入进行清理？
I'd argue you aren't doing it right. The right way to do this is to accept the text as sent from the server. Then to process all values received from the database with the
html, orhtml_entitiesfilter in your view (probablyTT). Why is this the right way? Well, if you don't want to support HTML now, you can still hack the filter to make a subset of HTML work later on. This also lets the user see their input -- just escaped -- rather than having it stripped thereby losing track of what they sent and some potentially valuable information.Your way also seems to make some assumptions about the output mechanism (HTML), that I'm uncomfortable with. Why would you want to sanitize on input for just one output format?
我正在使用 HTML::Scrubber，但这就是我想要实际允许的地方元素/属性的子集。
I'm using HTML::Scrubber, but that's where I want to actually allow a subset of elements/attributes.