Tell me more ×
Stack Apps is a question and answer site for apps, scripts, and development with the Stack Exchange API. It's 100% free, no registration required.
up vote 3 down vote favorite

Could someone clarify what this means? For example, what does it mean that the short_description field is Unchanged in unsafe filters for a Privilege?

share|improve this question

1 Answer

up vote 4 down vote accepted

See the "Safety" heading in the "Custom Filters" doc. The difference between a "safe" (default) filter and an "unsafe" filter, is that the unsafe data might return data that could result in a script injection if the data was directly inserted in an HTML document. (EG: '<script src="PwnYaSucka.com">...')

Some fields are apparently inherently devoid of potential injection problems, so even in "unsafe" filters, there is supposedly no risk of script injection. Those fields return the same data in both "safe" and "unsafe" filters and you do not have to worry about sanitizing problematic tags.

Fields that are inherently safe, like that, are tagged with the "unchanged in unsafe filters" disclaimer.

share|improve this answer
Thanks for the explanation... I figured it was something like that. If this is true, don't you think "unchanged in unsafe filters" should be re-worded somehow? I couldn't figure out what "unchanged" referred to... maybe "safe in unsafe filters?" Or maybe even something more detailed...? – Alex Lockwood Jul 31 '12 at 14:01
By calling it "unchanged", they carefully avoid the claim that it is "safe"... A possible CYA? ;) I don't control the verbiage, but yes, it might possibly be clearer for newbies, but they do link to the doc section that explains it. – Brock Adams Jul 31 '12 at 14:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged