[TYPO3-english] Re: Question typoscript security

[Christoph Werner]

Quote: Jigal van Hemert (jigal) wrote on Thu, 24 December 2015 13:28
----------------------------------------------------
> Hi,
> 
> On 24/12/2015 11:46, Christoph Werner wrote:
> > Hi all!
> >
> > I found two typoscript solutions for building canonical-Tags (seo
> > stuff). Solution 1 can be used when having records (news, blogposts...)
> > in action. When testing, both working like expected.
> >
> > My question: did I need some kind of escaping?! Expecially solution 1?
> > How could escaping look like?
> 
> There are several extensions in TER that can do it for you.
> 
> If you want to do it with TS, why not let typolink create the absolute URL?
> As far as encoding/escaping: in HTML4/XHTML it was necessary to turn "&" 
> characters into "&" inside an attribute value. For HTML5 this is 
> only needed if an entity name follows after the "&".
> To be safe apply htmlSpecialChars to the entire URL before wrapping it 
> with the tag.
> 
> 
> -- 
> Jigal van Hemert
> TYPO3 CMS Active Contributor
> 
> TYPO3 .... inspiring people to share!
> Get involved: typo3.org
----------------------------------------------------

Hi Jigal,

thx for your fast reply!

I try to use as less extensions as possible, makes me more "independent" and updates are easier.
Some more questions, sorry for that.

1.) Do I need the htmlSpecialChars in both examples?

2.) Would that be right:

lib.canonical = TEXT
lib.canonical {
    typolink {
        parameter = {page:uid}
        parameter.insertData = 1
        useCacheHash = 1
        addQueryString = 1
        addQueryString.method = GET
        addQueryString.exclude = id
        returnLast = url
    }
    htmlSpecialChars = 1
    wrap = <link rel="canonical" href="http://www.mydomain.com/|" />
}

3.) How can I use a typolink to create the absolute URL?

Best Regards
Chris