AUBBC
view release on metacpan or search on metacpan
The advantage of using this BBcode is to have the piece of mind of using a secure program,
to restrict the usage of HTML/XHTML elements and to make formatting of posts easy to people that have no HTML/XHTML skill.
Most sites that use these tags show a list of them and/or easy way to insert the tags to the form field by the user.
The [c] or code tags can highlight Perl code, highlighting the Perl code with CSS in HTML/XHTML,
and in the examples folder the tag_list.cgi file has a CSS code you could work from and now a setting to change to a costume highlighter function.
This module addresses many security issues the BBcode tags may have mainly cross site script also known as XSS.
Each message is escaped before it gets returned if script_escape is Enabled and checked for many types of security problems before that tag converts to HTML/XHTML.
The script_escape setting and method also converts the ' sign so the text can be stored in a SQL back-end.
Most of the free web portals use the | sign as the delimiter for the flat file database, the script_escape setting and method also converts that sign so the structure of the database is retained.
Allows easy conversion to HTML and XHTML, existing tags will convert to the HTML type set.
If there isn't a popular tag available this module provides a method to "Build your own tags" custom tags can help link to parts of the current web page, other web pages and add other HTML elements.
=cut
The advantage of using this BBcode is to have the piece of mind of using a secure program,
to restrict the usage of HTML/XHTML elements and to make formatting of posts easy to people that have no HTML/XHTML skill.
Most sites that use these tags show a list of them and/or easy way to insert the tags to the form field by the user.
The [c] or code tags can highlight Perl code, highlighting the Perl code with CSS in HTML/XHTML,
and in the examples folder the tag_list.cgi file has a CSS code you could work from and now a setting to change to a costume highlighter function.
This module addresses many security issues the BBcode tags may have mainly cross site script also known as XSS.
Each message is escaped before it gets returned if script_escape is Enabled and checked for many types of security problems before that tag converts to HTML/XHTML.
The script_escape setting and method also converts the ' sign so the text can be stored in a SQL back-end.
Most of the free web portals use the | sign as the delimiter for the flat file database, the script_escape setting and method also converts that sign so the structure of the database is retained.
Allows easy conversion to HTML and XHTML, existing tags will convert to the HTML type set.
If there isn't a popular tag available this module provides a method to "Build your own tags" custom tags can help link to parts of the current web page, other web pages and add other HTML elements.
=head1 Security
Security advice to ensure the proper usage of this module.
=head2 Database Manipulation
the fix converts the period and/or colon of the name so its not seen as a new
link.
Improvement - in do_unicode removed then changed the two regexs to do a 3 in 1 filter.
Improvement - in html_to_text added a code to fix a <br> bug if ppl use html or xhtml line break.
Improvement - moved the pattern building code from do_build_tag to add_build_tag
so it only runs one time
Improvement - in add_build_tag using a hash array to store the build tag data so
there is no need to use split in do_build_tag
Improvement - in do_all_ubbc moved script_escape to a location where one call
to the function is needed
Improvement - in do_all_ubbc added check for undefined "$message" variable
Improvement - in script_escape added check for undefined "$text" variable
Improvement - in html_to_text added check for undefined "$html" variable
Fixed Makefile.PL
v1.10 - 09/02/2008 09:49:46
Added two more tags [big]..[/big] and [small]..[/small].
Removed utf tag style [ux23] and [u://0931] to make more tag names available.
Changed add_build_tag() to use hash variable, see "Build your own tags" for the new style.
Changed the way functions should work for built tags, the custom function for built tags will receive the tag name and data of the tag. This is so one function can handle many tags.
Removed other site tags and setting other_sites_pattern, an example of them are in "Build your own tags"
Removed [time] tag, example in "Build your own tags".
Email now allows names with & sign
Now every message that is passed to do_all_ubbc() gets escaped before being returned if script_escape is Enabled.
All tags in %AUBBC_TAGS will only convert if lowercase.
the fix converts the period and/or colon of the name so its not seen as a new
link.
Improvement - in do_unicode removed then changed the two regexs to do a 3 in 1 filter.
Improvement - in html_to_text added a code to fix a <br> bug if ppl use html or xhtml line break.
Improvement - moved the pattern building code from do_build_tag to add_build_tag
so it only runs one time
Improvement - in add_build_tag using a hash array to store the build tag data so
there is no need to use split in do_build_tag
Improvement - in do_all_ubbc moved script_escape to a location where one call
to the function is needed
Improvement - in do_all_ubbc added check for undefined "$message" variable
Improvement - in script_escape added check for undefined "$text" variable
Improvement - in html_to_text added check for undefined "$html" variable
Fixed Makefile.PL
v1.10 - 09/02/2008 09:49:46
Added two more tags [big]..[/big] and [small]..[/small].
Removed utf tag style [ux23] and [u://0931] to make more tag names available.
Changed add_build_tag() to use hash variable, see "Build your own tags" for the new style.
Changed the way functions should work for built tags, the custom function for built tags will receive the tag name and data of the tag. This is so one function can handle many tags.
Removed other site tags and setting other_sites_pattern, an example of them are in "Build your own tags"
Removed [time] tag, example in "Build your own tags".
Email now allows names with & sign
Now every message that is passed to do_all_ubbc() gets escaped before being returned if script_escape is Enabled.
All tags in %AUBBC_TAGS will only convert if lowercase.
The advantage of using this BBcode is to have the piece of mind of using a secure program,
to restrict the usage of HTML/XHTML elements and to make formatting of posts easy to people that have no HTML/XHTML skill.
Most sites that use these tags show a list of them and/or easy way to insert the tags to the form field by the user.
The [c] or code tags can highlight Perl code, highlighting the Perl code with CSS in HTML/XHTML,
and in the examples folder the tag_list.cgi file has a CSS code you could work from and now a setting to change to a costume highlighter function.
This module addresses many security issues the BBcode tags may have mainly cross site script also known as XSS.
Each message is escaped before it gets returned if script_escape is Enabled and checked for many types of security problems before that tag converts to HTML/XHTML.
The script_escape setting and method also converts the ' sign so the text can be stored in a SQL back-end.
Most of the free web portals use the | sign as the delimiter for the flat file database, the script_escape setting and method also converts that sign so the structure of the database is retained.
Allows easy conversion to HTML and XHTML, existing tags will convert to the HTML type set.
If there isn't a popular tag available this module provides a method to "Build your own tags" custom tags can help link to parts of the current web page, other web pages and add other HTML elements.
=head1 Security
Security advice to ensure the proper usage of this module.
=head2 Database Manipulation
the fix converts the period and/or colon of the name so its not seen as a new
link.
Improvement - in do_unicode removed then changed the two regexs to do a 3 in 1 filter.
Improvement - in html_to_text added a code to fix a <br> bug if ppl use html or xhtml line break.
Improvement - moved the pattern building code from do_build_tag to add_build_tag
so it only runs one time
Improvement - in add_build_tag using a hash array to store the build tag data so
there is no need to use split in do_build_tag
Improvement - in do_all_ubbc moved script_escape to a location where one call
to the function is needed
Improvement - in do_all_ubbc added check for undefined "$message" variable
Improvement - in script_escape added check for undefined "$text" variable
Improvement - in html_to_text added check for undefined "$html" variable
Fixed Makefile.PL
v1.10 - 09/02/2008 09:49:46
Added two more tags [big]..[/big] and [small]..[/small].
Removed utf tag style [ux23] and [u://0931] to make more tag names available.
Changed add_build_tag() to use hash variable, see "Build your own tags" for the new style.
Changed the way functions should work for built tags, the custom function for built tags will receive the tag name and data of the tag. This is so one function can handle many tags.
Removed other site tags and setting other_sites_pattern, an example of them are in "Build your own tags"
Removed [time] tag, example in "Build your own tags".
Email now allows names with & sign
Now every message that is passed to do_all_ubbc() gets escaped before being returned if script_escape is Enabled.
All tags in %AUBBC_TAGS will only convert if lowercase.
examples/Database_Manipulation.cgi view on Meta::CPAN
# script_escape will need to be disabled in the settings method and
# this will tell the do_all_ubbc method not to use script_escape!
#
# other settings can be changed here if needed.
$aubbc->settings(
script_escape => 0,
);
# Build your own tags can be added, est......
# This will be the data or users input from a HTML form to save to a backend.
# The message will have some characters that would normaly brake some database
# structures, cause risky errors or be html.
my $message = <<FORM;
[b]Work[/b]
<i>This will not work</i>
Brake the database |||| ''''''''''' """"""
FORM
sub saving_data {
# This is to show how to save the user input safely to your backend
# you will need to use a module like CGI or what ever is out there
# to recive the HTML form data lets say the data is in $message
# Befor the data can be saved you will have to use the script_escape method on $message
$message = $aubbc->script_escape($message);
# Then save $message to your database, extra security methods maybe required or desired
# depending on the type of backend used.......
}
sub editing_data {
# This will be a two part subroutine. This first one will get the message from
# the backend and display the data in a HTML form to be edited lets say its
# in variable $form_data
# Since this gets into sandboxing the html_to_text method you may want
# to play with settings for other view's or can skip the form feilds sandboxing
# the option 1 for html_to_text is needed to not convert &, spaces, tab's
$form_data = $aubbc->html_to_text( $form_data );
# Now $form_data can be printed in the form feild
# When the HTML form is submitted we fictitiously sent the edited data to editing_data2
# of this file to be saved
}
sub editing_data2 {
# Part 2 of editing data, you will need to use a module like CGI or what ever is out there
# to recive the HTML form data
# Before the HTML form data can be saved you will have to use the script_escape
# method on the variable that holds the HTML form data lets say its $message2
$message2 = $aubbc->script_escape($message2);
# Then save it to your database, extra security methods maybe required or desired
# depending on the type of backend used.......
}
sub display_data {
# Get the data from the backend lets say we did that and its in $message3
# use do_all_ubbc on $message3 and now $message3 is ready to be printed in HTML.
$message3 = $aubbc->do_all_ubbc($message3);
# Here you would want to print the propper HTML headers and elements with $message3 in it
# or return the variable, how ever you want to make it!!
}
examples/Mixing_HTML_and_BBcode.cgi view on Meta::CPAN
# script_escape will need to be disabled in the settings method and
# this will tell the do_all_ubbc method not to use script_escape!
#
# other settings can be changed here if needed.
$aubbc->settings(
script_escape => 0,
);
# Build your own tags can be added, est......
# This will be the data or Administrator input from a HTML form to save to a backend.
# The message will have some BBcode mixed in HTML and a home made tage for full
# AUBBC support is <aubbc> Full AUBBC support </aubbc>
my $message = <<HTML;
<i>This will work</i> [i]This will work[/i]
[b]Work[/b] <b>Works too</b>
[email]safe\@email.com[/email]
<aubbc> [b]Full AUBBC support[/b]
<i>This will not work</i> [i]This will work[/i]
[b]Work[/b] <b>Not Work</b>
[email]safe\@email.com[/email]
</aubbc>
HTML
sub saving_data {
# This is to show how to save the user input safely to your backend
# you will need to use a module like CGI or what ever is out there
# to recive the HTML form data lets say the data is in $message
# Befor the data can be saved you will have to use the script_escape method on $message
# But not on the hole $message, so I use this filter to get the <aubbc> tag
$message =~ s/(<aubbc>(?s)(.*?)<\/aubbc>)/
my $ret = $aubbc->script_escape( $2 );
$ret ? '<aubbc>'.$ret."<\/aubbc>" : $1;
/exg;
# Then save $message to your database, extra security methods maybe required or desired
# depending on the type of backend used.......
}
sub editing_data {
# This will be a two part subroutine. This first one will get the message from
# the backend and display the data in a HTML form to be edited lets say its
# in variable $form_data
# Since this gets into sandboxing the script_escape method you may want
# to play with settings for other view's or can skip the form feilds sandboxing
# the option 1 for script_escape is needed to not convert spaces, tab's, new lines
$form_data =~ s/(<aubbc>(?s)(.*?)<\/aubbc>)/
my $ret = $aubbc->html_to_text( $2 );
$ret ? '<aubbc>'.$ret."<\/aubbc>" : $1;
/exg;
$form_data = $aubbc->script_escape( $form_data, 1 );
# Now $form_data can be printed in the form feild
# When the HTML form is submitted we fictitiously sent the edited data to editing_data2
# of this file to be saved
}
sub editing_data2 {
# Part 2 of editing data, you will need to use a module like CGI or what ever is out there
# to recive the HTML form data
# Before the HTML form data can be saved you will have to use the script_escape
# method with the regex on the variable that holds the HTML form data lets say its $message2
$message2 =~ s/(<aubbc>(?s)(.*?)<\/aubbc>)/
my $ret = $aubbc->script_escape( $2 );
$ret ? '<aubbc>'.$ret."<\/aubbc>" : $1;
/exg;
# Then save it to your database, extra security methods maybe required or desired
# depending on the type of backend used.......
}
sub display_data {
# Get the data from the backend lets say we did that and its in $message3
# use do_all_ubbc on $message3 and
$message3 = $aubbc->do_all_ubbc($message3);
# Before you print we want to remove the <aubbc> home made element
$message3 =~ s{\<\/?aubbc\>}{}g;
# now $message3 is ready to be printed in HTML.
# Here you would want to print the propper HTML headers and elements with $message3 in it
# or return the variable, how ever you want to make it!!
( run in 0.340 second using v1.01-cache-2.11-cpan-8d75d55dd25 )