%META:TOPICINFO{author="ProjectContributor" date="1231502400" format="1.1" version="1"}%
%META:TOPICPARENT{name="Macros"}%
#VarENCODE
---+++ ENCODE{"string"} -- encodes a string to HTML entities
   * Encode "special" characters to HTML numeric entities. Encoded characters are:
      * all non-printable ASCII characters below space, except newline (="\n"=) and linefeed (="\r"=)
      * HTML special characters ="<"=, =">"=, ="&"=, single quote (='=) and double quote (="=)
      * TML special characters ="%"=, ="["=, ="]"=, ="@"=, ="_"=, ="*"=, ="="= and ="|"=
   * Syntax: =%<nop>ENCODE{"string"}%=
   * Supported parameters:
     | *Parameter:* | *Description:* | *Default:* |
     | ="string"= | String to encode | required (can be empty) |
     | =type="entity"= <br /> =type="safe"= <br /> =type="html"= <br /> =type="quotes"= <br /> =type="url"= | Control how special characters are encoded <hr /> =entity=: Encode special characters into HTML entities, like a double quote into =&amp;#034;=. Does *not* encode =\n= or =\r=. <hr /> =safe=: Encode characters ='"&lt;&gt;%= into HTML entities. <hr /> =html=: As =type="entity"= except it also encodes =\n= and =\r= <hr /> =quotes=: Escape double quotes with backslashes (=\"=), does not change other characters <hr /> =url=: Encode special characters for URL parameter use, like a double quote into =%22= (this is the default) | =type="url"= |
   * Example: =%<nop>ENCODE{"spaced name"}%= expands to =%ENCODE{"spaced name"}%=
   * %X% Values of HTML input fields must be entity encoded.%BR% Example: =&lt;input type="text" name="address" value="%<nop>ENCODE{ "any text" type="entity" }%" /&gt;=
   * %X% Double quotes in strings must be escaped when passed into other macros.%BR% Example: =%<nop>SEARCH{ "%<nop>ENCODE{ "string with "quotes"" type="quotes" }%" noheader="on" }%=
   * %X% ENCODE can be used to filter user input from URL parameters and similer to protect against cross-site scripting. The safest approach is to use =type="entity"=. This can however prevent an application from fully working. You can then use =type="safe"= which encodes only the characters ='"&lt;&gt;%= into HTML entities (same as encode="safe"). When ENCODE is passing a string inside another macro always use double quotes ("") type="quote". For maximum security against cross-site scripting you are adviced to install the Foswiki:Extensions.SafeWikiPlugin.

   * Related: [[%IF{"'%INCLUDINGTOPIC%'='Macros'" then="#"}%VarURLPARAM][URLPARAM]]

