Use ESAPIEncode() or EncodeForHTML() in Lucee 4.5 vs. Lucee 5?

[thorste...@googlemail.com]

Hi,

at the moment I use XMLFormat() to encode user output in my views on Lucee 4.5.

Would it be better to user ESAPIEncode('HTML',string) in Lucee 4.5, because EncodeForHTML() is deprecated?

http://docs.lucee.org/reference/functions/encodeforhtml.html

http://docs.lucee.org/reference/functions/esapiencode.html

But what's recommended for Lucee 5? I read somewhere EncodeForHTML() will be reactivated in Lucee 5?

Confused.

Thorsten

[Harry Klein]

Hi Thorsten,

 

I was also confused, see this thread:

https://groups.google.com/forum/#!topic/lucee/90xgx_wnVs4

 

-Harry

--
Love Lucee? Become a supporter and be part of the Lucee project today! - http://lucee.org/supporters/become-a-supporter.html
---
You received this message because you are subscribed to the Google Groups "Lucee" group.
To unsubscribe from this group and stop receiving emails from it, send an email to lucee+un...@googlegroups.com.
To post to this group, send email to lu...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/4f29ce9b-20f5-4967-99f9-b4fa082ea724%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Zac Spitzer]

it would be nice to have a less verbose shortcut like underscore templates

i.e. <%=output_var_unescaped %> and <%-output_var_escaped %>

for traditional CFML with #'s

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/F5A941E045A6FE4288ABB2E3D797146FA7482119%40SRV-DC1.contens.local.

For more options, visit https://groups.google.com/d/optout.

--

Zac Spitzer
+61 405 847 168

[Risto]

Wouldn't CFML be less verbose as you can use as few cfoutput blocks as you like?
For example, in my CMS detail template I have just one cfoutput block with up to 15 variables that just have # surrounding it.

[Pete Freitag]

I would use encodeForHTML for several reasons:

1) ESAPIEncode will be deprecated in Lucee 5 (according to Brad Wood's post on the forum which Harry Klein posted a link to)

2) encodeForHTML is supported by both Lucee and ACF

3) The function name encodeForHTML is much more readable and clear as to what its purpose is, than ESAPIEncode("html", v).

FYI ACF2016 has added <cfoutput encodeFor="html"> are there any plans for supporting this in Lucee?

--

Pete Freitag
https://foundeo.com/ - ColdFusion Consulting & Products
http://hackmycf.com - CFML Server Security Scanner

--

[Brad Wood]

> FYI ACF2016 has added <cfoutput encodeFor="html"> are there any plans for supporting this in Lucee?

Nice feature, I hadn't heard about that one.  Someone just needs to put in a ticket for it.  What will be cool is that on Lucee, you could set that to be your default for the cfoutput tag if you wished in Application.cfc.

Thanks!

~Brad

[Mark Drew]

Added https://luceeserver.atlassian.net/browse/LDEV-817

MD 

--
Love Lucee? Become a supporter and be part of the Lucee project today! - http://lucee.org/supporters/become-a-supporter.html
---
You received this message because you are subscribed to the Google Groups "Lucee" group.
To unsubscribe from this group and stop receiving emails from it, send an email to lucee+un...@googlegroups.com.
To post to this group, send email to lu...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/lucee/ecc85983-41d5-45f3-862f-b7a6384acb83%40googlegroups.com.