Filter HTML/SCRIPT input from textfields

[Vircos]

For security reasons sometimes it is handy to filter any html or script input from a textfield. As far as I know Ebase lacks this functionality at the moment. Is it possible to implement such a functionality?

[Joost]

You possibly could create a customfunction which calls following code. You could enhance it to be able to allow specific html tags or characters.

Code: Select all

package nl.oss.utils;

public class XmlUtil {
    static char&#91;&#93;   specialCharacters  = &#123; '&',     '<',    '>',    '\'',     '"' &#125;;
    static String&#91;&#93; replacementStrings = &#123; "&amp;", "&lt;", "&gt;", "&apos;", "&quot" &#125;;
 
    /**
     * Sanitizes input string by replacing &amp;, &lt;, &gt;, ' and &quot; to 
     * the predefined entities &amp;amp;, &amp;lt;, &amp;gt;, &amp;apos; and 
     * &amp;quot;.
     * 
     * @param text string to sanitize.
     * 
     * @return     Sanitized string.
     * 
     * @see http&#58;//java.sun.com/j2ee/1.4/docs/tutorial/doc/IntroXML3.html
     * @see http&#58;//forum.java.sun.com/thread.jspa?threadID=294114&messageID=1161051
     */
    public static String sanitizeTextLite&#40; String text &#41; &#123;
        StringBuffer buffer = new StringBuffer&#40; text &#41;;
 
        for&#40; int i = 0; i < buffer.length&#40;&#41;; i++ &#41; &#123;
            for&#40; int k = 0; k < specialCharacters.length; k++ &#41; &#123;
                if&#40; buffer.charAt&#40;i&#41; == specialCharacters&#91;k&#93; &#41; &#123;
                     buffer.replace&#40; i, i + 1, replacementStrings&#91;k&#93; &#41;;
                     i += replacementStrings&#91;k&#93;.length&#40;&#41;;
                &#125;
            &#125;
        &#125;
        return buffer.toString&#40;&#41;;
    &#125;

    /**
     * Sanitizes input string by replacing &amp;, &lt;, &gt;, ' and &quot; to 
     * the predefined entities &amp;amp;, &amp;lt;, &amp;gt;, &amp;apos; and 
     * &amp;quot;. 
     * Additionally replaces unicode characters above 128 to character 
     * references such as “. 
     * 
     * @param text string to sanitize.
     * 
     * @return     Sanitized string.
     * 
     * @see http&#58;//java.sun.com/j2ee/1.4/docs/tutorial/doc/IntroXML3.html
     * @see http&#58;//forum.java.sun.com/thread.jspa?threadID=294114&messageID=1161051
     */
    public static String sanitizeText&#40; String text &#41; &#123;
        StringBuffer buffer = new StringBuffer&#40; text &#41;;
 
        for&#40; int i = 0; i < buffer.length&#40;&#41;; i++ &#41; &#123;
            for&#40; int k = 0; k < specialCharacters.length; k++ &#41; &#123;
                if&#40; buffer.charAt&#40;i&#41; == specialCharacters&#91;k&#93; &#41; &#123;
                     buffer.replace&#40; i, i + 1, replacementStrings&#91;k&#93; &#41;;
                     i += replacementStrings&#91;k&#93;.length&#40;&#41;;
                &#125; else if&#40; &#40;int&#41;buffer.charAt&#40;i&#41; > 128 &#41; &#123;
                     String replacement = "&#" + &#40;int&#41;buffer.charAt&#40;i&#41; + ";";
                     buffer.replace&#40; i, i + 1, replacement &#41;;
                     i += replacement.length&#40;&#41;;
                &#125;
            &#125;
        &#125;
        return buffer.toString&#40;&#41;;
    &#125;

&#125; // class XmlUtil

You call it from your customfunction with:

Code: Select all

language 		= XmlUtil.sanitizeTextLite( form.getFieldValue("LANGUAGE") );

[Vircos]

Thank you Joost. I surely will give it try