diff options
| author | Rory O’Kane <rory@roryokane.com> | 2012-04-26 18:24:38 -0300 |
|---|---|---|
| committer | Rory O’Kane <rory@roryokane.com> | 2012-04-26 18:24:38 -0300 |
| commit | 504e539166ab3528e6377ae8bcf5ddacb3572729 (patch) | |
| tree | 5c9dab0b05891934f186ecde57be5d2c12529627 /guides/source/active_support_core_extensions.textile | |
| parent | 8bf97d1a845385290f20f76ea1256712c2c4735e (diff) | |
| download | rails-504e539166ab3528e6377ae8bcf5ddacb3572729.tar.gz rails-504e539166ab3528e6377ae8bcf5ddacb3572729.tar.bz2 rails-504e539166ab3528e6377ae8bcf5ddacb3572729.zip | |
Active Support Core Extensions guide: reworded "on one hand" and similar to "for one thing"
Diffstat (limited to 'guides/source/active_support_core_extensions.textile')
| -rw-r--r-- | guides/source/active_support_core_extensions.textile | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/guides/source/active_support_core_extensions.textile b/guides/source/active_support_core_extensions.textile index 5d0a3f82e8..e4a6e145b9 100644 --- a/guides/source/active_support_core_extensions.textile +++ b/guides/source/active_support_core_extensions.textile @@ -1131,7 +1131,7 @@ h4. Output Safety h5. Motivation -Inserting data into HTML templates needs extra care. For example you can't just interpolate +@review.title+ verbatim into an HTML page. On one hand if the review title is "Flanagan & Matz rules!" the output won't be well-formed because an ampersand has to be escaped as "&amp;". On the other hand, depending on the application that may be a big security hole because users can inject malicious HTML setting a hand-crafted review title. Check out the "section about cross-site scripting in the Security guide":security.html#cross-site-scripting-xss for further information about the risks. +Inserting data into HTML templates needs extra care. For example, you can't just interpolate +@review.title+ verbatim into an HTML page. For one thing, if the review title is "Flanagan & Matz rules!" the output won't be well-formed because an ampersand has to be escaped as "&amp;". What's more, depending on the application, that may be a big security hole because users can inject malicious HTML setting a hand-crafted review title. Check out the "section about cross-site scripting in the Security guide":security.html#cross-site-scripting-xss for further information about the risks. h5. Safe Strings |