diff options
Diffstat (limited to 'framework/Web/UI/WebControls/TSafeHtml.php')
| -rw-r--r-- | framework/Web/UI/WebControls/TSafeHtml.php | 21 |
1 files changed, 19 insertions, 2 deletions
diff --git a/framework/Web/UI/WebControls/TSafeHtml.php b/framework/Web/UI/WebControls/TSafeHtml.php index 432cb104..a625a84d 100644 --- a/framework/Web/UI/WebControls/TSafeHtml.php +++ b/framework/Web/UI/WebControls/TSafeHtml.php @@ -13,6 +13,23 @@ /**
* TSafeHtml class
*
+ * TSafeHtml is a control that strips down all potentially dangerous
+ * HTML content. It is mainly a wrapper of {@link http://pixel-apes.com/safehtml/ SafeHTML}
+ * project. According to the SafeHTML project, it tries to safeguard
+ * the following situations when the string is to be displayed to end-users,
+ * - Opening tag without its closing tag
+ * - closing tag without its opening tag
+ * - any of these tags: base, basefont, head, html, body, applet, object,
+ * iframe, frame, frameset, script, layer, ilayer, embed, bgsound, link,
+ * meta, style, title, blink, xml, etc.
+ * - any of these attributes: on*, data*, dynsrc
+ * - javascript:/vbscript:/about: etc. protocols
+ * - expression/behavior etc. in styles
+ * - any other active content.
+ *
+ * To use TSafeHtml, simply enclose the content to be secured within
+ * the body of TSafeHtml in a template.
+ *
* @author Wei Zhuo <weizhuo[at]gmail[dot]com>
* @version $Revision: $ $Date: $
* @package System.Web.UI.WebControls
@@ -26,10 +43,10 @@ class TSafeHtml extends TControl * malicious javascript code from the body content
* @param THtmlWriter writer
*/
- public function renderContents($writer)
+ public function render($writer)
{
$textWriter=new TTextWriter;
- parent::renderContents(new THtmlWriter($textWriter));
+ parent::render(new THtmlWriter($textWriter));
$writer->write($this->parseSafeHtml($textWriter->flush()));
}
|