HTML::...scapes(3pm)

💖 HTML::Mason::Escapes 💖

okay bestie, so this is the manual page for HTML::Mason::Escapes, and it lives in section 3pm of the User Contributed Perl Documentation, iykyk 🎀 pull up a chair, we're talking about escaping text for Mason.

---

✨ NAME ✨

HTML::Mason::Escapes — literally just functions that escape text for Mason, no cap 🦋

---

🌸 DESCRIPTION 🌸

so this module is where Mason keeps the functions that make its substitution escaping feature work ✨. and the cute part? you can also call these functions directly yourself — they're not gatekept, bestie 💅

🧚 html_entities_escape

this one takes a scalar reference and HTML-escapes it using the HTML::Entities module 🌈

by default, this module assumes the string it's escaping is in ISO-8859-1 (that's pre Perl 5.8.0) or UTF-8 (Perl 5.8.0 onwards) 👑

so if your data is NOT in one of those encodings, you're gonna wanna override this escape to do the right thing for your encoding. do not just vibe past this, fr fr 😭

see the section on User-defined Escapes in the Developer's Manual for more deets on how to actually do that 🫶

🦋 url_escape

this one takes a scalar reference and replaces any text it contains matching [^a-zA-Z0-9_.-] with the URL-escaped equivalent 💫

and what's that equivalent? a percent sign (%) followed by the hexadecimal number of that character 🌸 iconic behaviour honestly

👑 basic_html_escape

this function takes a scalar reference and HTML-escapes it, escaping the following characters: '&', '>', '<', and '"' ⭐

it's provided for those who wish to use it to replace (or supplement) the existing 'h' escape flag, via the Interpreter's set_escape() method 💜

⚠️ okay this next part is IMPORTANT, bestie, listen up. this function is provided in order to allow people to return the HTML escaping behavior in 1.0x. HOWEVER, this behavior presents a potential security risk of allowing cross-site scripting attacks 💀💀💀

HTML escaping should always be done based on the character set a page is in. merely escaping the four characters mentioned above is not sufficient 😤

the quick summary of why: for some character sets, characters other than '<' may be interpreted as a "less than" sign, meaning that just filtering '<' and '>' will not stop all cross-site scripting attacks 🙈

see http://www.megasecurity.org/Info/cross-site_scripting.txt for more details 🔥

---

and that's the whole page, bestie!! 🎀 this was written for perl v5.38.2, dated 2024-03-05, and it's the HTML::...scapes(3pm) manpage — go forth and escape responsibly, mwah 💖✨🦋