Forum Helpers List: Escape < and > in user bios rather than removing them

[penguinmoose]

Describe the changes needed
I think it would be better to escape < and > in user bios instead of simply removing them. That way, people can insert < and > without them being removed and still not interfering with the webpage.

Also, this is the standard way of handling special characters (by escaping them).

< can be replaced with &lt to escape
> can be replaced with &gt to escape

Additional context
When updating a user’s bio through that user’s dashboard, < and > will be removed in the user’s bio so that they don’t actually become tags when displayed on the webpage. I think it would be better to escape them instead.

[leahcimto]

These characters are used barely at all so this is low priority.

[penguinmoose]

These characters are used barely at all so this is low priority.

Got it.

[Steve0Greatness]

I know exactly how this would be done. On line 13 of forumhelpers/FHP.js before the semicolon, add .replace(/</g, "&lt;").replace(/>/g, "&gt;"), it's very easy to pull off.

[leahcimto]

I know exactly how this would be done. On line 13 of forumhelpers/FHP.js before the semicolon, add .replace(/</g, "&lt;").replace(/>/g, "&gt;"), it's very easy to pull off.

The Dashboard currently just ignores < and >. If someone's bio has < or > the dashboard simply will remove it. also<and &gt; automatically make < and > when the webpage is displayed as far as I know.

[penguinmoose]

@leahcimto What do you mean by "also < and > automatically make < and > when the webpage is displayed as far as I know"?

[Accio1]

Currently, these characters are removed automatically by the dashboard when someone submits a bio. This was implemented alongside other measures to prevent XSS. I don't think these characters are commonly used in bios anyway so I'm labelling this needs discussion pending more conversation.

[leahcimto]

@leahcimto What do you mean by "also < and > automatically make < and > when the webpage is displayed as far as I know"?

Edited, Markdown even displayed them as < and >

[penguinmoose]

@Accio1 I was just bringing this up as an alternative. I agree that it isn't very high priority.