Repository files navigation

Houdini doesn't quite qualify as a library. In fact, I didn't even botherto write a Makefile (well, others did). It's zero-dependency and modular.Just stick the files you need in your project. Or go with all of them(e.g. via git submodule) and use the static library that is built bydefault when GNU make is invoked. Now you can freely escape some shit.

Houdini is a simple API for escaping text for the web. And unescaping it.But that kind of breaks the joke in the name so nevermind.

• HTML escaping follows the OWASP suggestion. All other entities are leftas-is.

    & --> &amp;  < --> &lt;  > --> &gt;  " --> &quot;  ' --> &#x27;     &apos; is not recommended  / --> &#x2F;     forward slash is included as it helps end an HTML entity

• HTML unescaping is fully RFC-compliant. Yes, that's the 253 different entitiesfor you, and decimal/hex code point specifiers.

• URI escaping and unescaping is fully RFC-compliant.

• URL escaping and unescaping is the same as generic URIs,but spaces are changed to+.

WARNING: Houdini parsesonly UTF-8 strings, and generatesonlyUTF-8 strings. If you are using another encoding, you should probably transcodebefore passing the buffer to Houdini.

Do you really need docs for this?

inthoudini_escape_html(gh_buf*ob,constuint8_t*src,size_tsize);inthoudini_escape_html0(gh_buf*ob,constuint8_t*src,size_tsize,intsecure);inthoudini_unescape_html(gh_buf*ob,constuint8_t*src,size_tsize);inthoudini_escape_xml(gh_buf*ob,constuint8_t*src,size_tsize);inthoudini_escape_uri(gh_buf*ob,constuint8_t*src,size_tsize);inthoudini_escape_url(gh_buf*ob,constuint8_t*src,size_tsize);inthoudini_escape_href(gh_buf*ob,constuint8_t*src,size_tsize);inthoudini_unescape_uri(gh_buf*ob,constuint8_t*src,size_tsize);inthoudini_unescape_url(gh_buf*ob,constuint8_t*src,size_tsize);inthoudini_escape_js(gh_buf*ob,constuint8_t*src,size_tsize);inthoudini_unescape_js(gh_buf*ob,constuint8_t*src,size_tsize);

Pass your string. It'll get escaped/unescaped in the target buffer, and the call will return 1.If the given string has nothing to escape/unescape, the call will return 0 and theoutput buffer will be empty.

Open an issue. Or shout angrily at me on Twitter (@vmg).