StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POGuide to proper escaping in Play framework
primarykey
Id
5764679
data
AcceptedAnswerId
14837123
AnswerCount
2
ClosedDate
CommentCount
5
CommunityOwnedDate
CreationDate
2011-04-23T14:17:02.220
FavoriteCount
8
LastActivityDate
2015-06-25T09:00:11.780
LastEditDate
2017-05-23T11:45:38.073
LastEditorUserId
-1
OwnerUserId
277156
ParentId
0
PostTypeId
1
Score
26
ViewCount
10916
LastEditorDisplayName
text
Body
I'm trying to map out how the Play framework supports escaping. This is a nice page spelling out the needed functionality: <a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet" rel="nofollow noreferrer">https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet</a> So I'm trying to relate that to Play template features and fully understand what Play does and doesn't do. <ul> <li>HTML escaping: <code>${}</code> or the <code>escape()</code> function</li> <li>Attribute escaping: I can't find a built-in solution</li> <li>JavaScript escaping: there's an <code>escapeJavaScript()</code> <a href="http://www.playframework.org/documentation/1.2/javaextensions" rel="nofollow noreferrer">http://www.playframework.org/documentation/1.2/javaextensions</a></li> <li>CSS escaping: I can't find a built-in solution</li> <li>URL escaping: nothing special built-in, but usual Java solution e.g. <a href="https://stackoverflow.com/questions/607176/java-equivalent-to-javascripts-encodeuricomponent-that-produces-identical-output">Java equivalent to JavaScript's encodeURIComponent that produces identical output?</a> - Update: there's urlEncode() at <a href="http://www.playframework.org/documentation/1.2/javaextensions" rel="nofollow noreferrer">http://www.playframework.org/documentation/1.2/javaextensions</a></li> </ul> Another point of confusion is the support for <code>index.json</code> (i.e. using templates to build JSON instead of HTML). Does <code>${}</code> magically switch to JavaScript escaping in a JSON document, or does it still escape HTML, so everything in a JSON template has to have an explicit <code>escapeJavaScript()</code>? There's also an addSlashes() on <a href="http://www.playframework.org/documentation/1.2/javaextensions" rel="nofollow noreferrer">http://www.playframework.org/documentation/1.2/javaextensions</a> , but it doesn't seem quite right for any of the situations I can think of. (?) It would be great to have a thorough guide on how to do all the flavors of escaping in Play. It looks to me like the answer is "roll your own" in several cases but maybe I'm missing what's included. 
Tags
<java><security><escaping><xss><playframework>
Title
Guide to proper escaping in Play framework
singulars
PostAcceptedAnswerId
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. USCommunity
UserOwnerUserId
1. USHavoc P
plurals
PostLinksPostIdRelatedPostId
1. PL
 singulars
 LinkTypeLinkTypeId
 LTLinked
2. PL
 singulars
 LinkTypeLinkTypeId
 LTLinked
PostLinksRelatedPostIdPostId
1. PL
 singulars
 LinkTypeLinkTypeId
 LTLinked
2. PL
 singulars
 LinkTypeLinkTypeId
 LTLinked
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
2. PO
 singulars
 PostTypePostTypeId
 PTAnswer
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 POGuide to proper escaping in Play framework
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
2. VO
 singulars
 PostPostId
 POGuide to proper escaping in Play framework
 UserUserId
 USHavoc P
 VoteTypeVoteTypeId
 VTBountyStart
3. VO
 singulars
 PostPostId
 POGuide to proper escaping in Play framework
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
CommentsPostId

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.