Search code examples
securitycoldfusioncoldfusion-10esapi

Should encodeForHtml() & encodeForURL() be used from CF10 onward, in favor of htmlEditFormat() & urlFormat()?


In an earlier question encodeForHtml() vs htmlEditFormat(), how are they different, it seems like the new encodeForHtml() & encodeForURL() functions are superior to htmlEditFormat() & urlFormat() respectively.

Should the esapi-based encodeForXXX functions be used in favor of the existing ones? Should the 2 older functions be deprecated?

Thank you.


Solution

  • I have no idea if the two older functions would be deprecated. But I would say that using the new functions would be a good idea, unless you need to support backward compatibility.