File Coverage

blib/lib/Data/FormValidator/Filters/HTMLStrip.pm

Criterion	Covered	Total	%
statement	14	25	56.0
branch			n/a
condition			n/a
subroutine	4	7	57.1
pod	1	1	100.0
total	19	33	57.5

package Data::FormValidator::Filters::HTMLStrip;

use strict;
use HTML::Strip;

=pod

=head1 NAME

Data::FormValidator::Filters::HTMLStrip - Filter that removes html tags from input

=head1 SYNOPSIS

    use Data::FormValidator::Filters::HTMLStrip qw( html_strip );

    # Build a Data::FormValidator Profile:
    my $my_profile = {
        required => qw( text ),
        field_filters => {
            text => html_strip,
        },
    };

    # Be sure to use a CGI.pm object as the form input
    # when using this filter
    my $q = new CGI;
    my $dfv = Data::FormValidator->check($q,$my_profile);

=head1 DESCRIPTION

This is a Data::FormaValidator filter that acts as a wrapper for HTML::Strip.
It removes html tags from variable data to help protect against cross-site
scripting attacks.

=cut

use vars qw( $VERSION @ISA @EXPORT @EXPORT_OK );

BEGIN {
    require Exporter;

    $VERSION = '0.13';

    @ISA = qw( Exporter );

    @EXPORT    = ();
    @EXPORT_OK = qw( html_strip );
}

=pod

=head1 FILTERS


=head2 html_strip

This will create a filter that will strip html tags from
the value of filtered variables. This assists in protecting cross site
scripting exploits from users attempting to embed html tags into input
fields.

=cut

sub html_strip {
    my %options = @_;
    return
          sub { return __clean_data( shift, %options ) };
}

sub __clean_data {
    my $data        = shift;
    my @the_rest    = @_;

    my $hs = HTML::Strip->new(@the_rest);
    my $clean = $hs->parse( $data );
    $hs->eof();
    $clean =~ s/>/>\;/g;
    $clean =~ s/
    return $clean
}

1;

__END__