#27
May 04
Cross Site Scripting
Another common security issue is cross site scripting. In this episode you will see why it is so important to escape any HTML a user may submit.
<%=h comment.content %>CGI::escapeHTML(...)



Thanks for another great screencast tutorial!
Keep up the great work!
Thanks. I missed this security hole in many places :).
Thanks again!
Good topic, Ryan. Cross-site scripting is such a common problem and really needs plenty of attention.
Please let me know if you are unable to transfer the iPod version to your iPod/Apple TV. I may have got the compression settings incorrect or something.
Ryan, I haven't yet tried the download for iPod option, but I was just curious: what's the difference between that version and the regular one? Is it just more compressed?
Good question. It's 640x480 instead of 800x600 and the compression doesn't look as nice, so if you don't need to play it back on an iPod/Apple TV it's definitely better to stick with the higher quality version.
Thanks Ryan. I'll probably start downloading the iPod versions though... that way I can take the casts with me on trips (Sadly, I don't have a laptop yet). As much as I like the higher quality, I find no reason to download the videos twice (and I might as well save you a little bandwidth). Thanks and keep up the good work!
Thanks Ryan for these excelent screencasts.
Keep it up
congrats from México.
For those interested, the iPod format should be working now. Sorry about the incompatable file format.
Hey Ryan,
I was JUST about to whine about the iPod version. :) Thanks for another great tute and for reading my mind!
Very useful issue!
I find the ipod versions hard to read because they're too blurry (the normal versions are fantastic, incredibly clear!).
I suppose that's because the resolution has been reduced, but is it also because of higher compression? h264 should be able to do clear video, is it possible to turn up the bitrate?
Anyway, these railscasts are very useful, keep up the great work!
<script>alert('Hi!')</script> :D
cool...downloading them right now..
Hey, I wrote a quick informative tutorial about XSS on http://www.snailrails.com/2008/1/cross-site-scripting.
Check it out for some more information.