Question

Using ColdFusion 8 I usually escape all my form inputs like so:

<input id="foo" value="#XMLFormat(trim( form_name.param_name ))#" />

So how about hidden inputs? Should these also be escaped? I haven’t tried, but I could very well pull a hidden input up in Firebug, enter whatever and try to submit, can I?

Answer 1

The goal of escaping in this case is to keep the HTML well formed so yes – hidden vars need to be escaped (or encoded) as well. I usually use urlencodedformat() for this. Consider what would happen if the value you were placing in the hidden var were a variable like this:

<cfset form.fullname= 'Bob "the tiger" Johnson'/>

<input type="hidden" name="fullname" value="#form.fullname#"/>

The output would actually look like this:

<input type="hidden" name="fullname" value="Bob "the Tiger" Johnson"/>

This would mean your hidden var would come through as “Bob ” … and the rest would be lost. The situation might get worse if any part of your strings contain HTML or slashes or angle brackets.