On Sun, Nov 17, 2002 at 10:12:39AM +0200, [EMAIL PROTECTED] wrote:
> Has your input come from Mozilla? It does that. To make sure, write a cgi script
> (if you don't trust PHP) that displays its input as text/plain, and create a
> form in UTF8 that sends to that script.

Actually, both IE5 and Mozilla will encode characters which aren't
present in the charset of the page which contains the HTML form, as
Unicode "entities" (e.g. &#blah;).

<!-- Side node:
In some ways, it's nice, since it "fixes" many broken web applications,
which have ISO-8859-1 hardcoded into them. On the other hand, it's sad
to know those web applications are suspectible for "cross-site
scripting" attacks, since apparently they don't safely encode the
user-given strings they output later to the HTML stream.
-->

To avoid this behavior, simply make this page, which contains the
HTML form, in any Unicode encoding -- UTF-8, UTF-7 or UCS-2 (yuck!).

=================================================================
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]

Reply via email to