concrete5/concrete5 — pull request #881 by bluefuton (2013-02-01 10:35:12+00:00)
Title: Security: helper for sanitizing input and escaping output

I put a concrete5-driven site through a security audit recently and there a number of places where improvements could be made on input sanitization and escaping HTML output.

I wanted to provide a consistent way of doing this, supported by a helper in core.

There's also a Rails-influenced h() function for quick escaping of HTML output:

http://stackoverflow.com/questions/296747/whats-the-h-mean-in-h

I have provided a couple of examples of the new helper in use.

I have a tranche of security fixes to contribute off the back of this, but I wanted to check my general approach with the community before I do so.