N.B. This is to fix the Client Side stuff, NOT server side things.

Problem:

Consider this:

<script type=”text/javascript”>

<!–

var text = ‘<script>alert(\’Boo!\’);</script>’;

document.write(text);

–>

See the problem that any input however it is obtained (Eg. Form) isn’t converted into text, but left as html.

Yes, I know that this doesn’t pose a great security risk as the client has to type it in, however that is no excuse!

If my name is <script>alert(’Boo!’);</script> and my javascript says hello and a alert… Well!

So what is the Fix?

Solution:

I have made a function called htmlsafe which is the same as htmlentities($str, ENT_QUOTES); In PHP.

htmlsafe.js (PGP Sig (For Geeks))

htmlsafecompressed.js (PGP Sig (For Geeks))
The script also contains nl2br and br2nl (Just like PHP does).