Search code examples
formscoldfusioncoldfusion-8owasp

Format of ESAPI encode in an output with DecimalFormat

I'm currently working through several forms with outputs to the user and I've successfully applied the #esapiEncoder.encodeForHTML()# without issue thus far but I'm thrown as to whether this is the correct way of typing out an encode when DecimalFormat is part of it.

#esapiEncoder.encodeForHTML(DecimalFormat(hrsTotalLeave))#

Would that be the correct method? Or is it:

#DecimalFomat(esapiEncoder.encodeForHTML(hrsTotalleave))#

This page is using ColdFusion if that helps at all.

Solution

  • I believe that you want to encode your values at the outermost level, so #esapiEncoder.encodeForHTML(DecimalFormat(hrsTotalLeave))# would be the way to go.

    Using your second example and attempting to use format functions on encoded strings will potentially lead to issues as well.