# Escape & Sanitize User Input

## Background

Generate a book with user content.

## Problem

Names like Marie Curie-Sk\l{}odowska, when not escaped (e.g., MARIE CURIE-SKŁODOWSKA) cause LaTeX to fail.

## Questions

• What macros are available to ensure that characters are translated into their LaTeX-friendly equivalents?
• How do you prevent items like \input{/etc/passwd}?

Thank you!

-
I don't think this is the best title for your question. "sanitizing" usually refers to removing (harmful) markup from the input. –  Alan Munn Jan 11 '11 at 1:38
I'd be more worried about people entering backslashes, particularly in the form of things like \input{\etc\passwd} or \write18{rm -rf /} (though the latter is usually disabled nowadays). –  Caramdir Jan 11 '11 at 1:48
Clean the input before it ever reaches TeX. String manipulations are way easier in general purpose programming languages and some things are probably impossible to do correctly in TeX. Don't forget about $, braces, %, etc. – Caramdir Jan 11 '11 at 2:10 @Caramdir: Thanks for mentioning escaping reserved characters. I've updated my answer to reflect this. – Alan Munn Jan 11 '11 at 3:18 add comment ## 1 Answer Depending on what input you need, just encoding your document as UTF-8 (\usepackage[utf8]{inputenc}) will allow unescaped unicode characters. If you need more variety than the major Latin-based languages, you should use XeLaTeX, (which assume unicode source) and a font that contains as many of the scripts as you might need (or you'll need to adjust your input cgi to choose the appropriate language and pass it to your document.) You also need to decide how to handle characters that are reserved by LaTeX, but might be part of your allowable input (#, %,$, _, ^, &, {, }) which should probably be turned into \#, \% etc. This can easily be done with a regular expression substitution in your cgi script. (Although if you need to allow math input, this is more complicated.)

As for sanitizing dangerous stuff from the input, the safest is to not allow any latex markup at all, in which case can you can simply strip out all instances of \ from your input text. (And obviously don't run latex with the -shell-escape option.) If you need limited markup, this can be doable, but trickier, depending on what you want to allow.

-
@Dave, What encoding does your editor use? –  Caramdir Jan 11 '11 at 2:10
@Dave Jarvis. Sorry, but I doubt this is true. LyX uses intenally Unicode wiki.lyx.org/LyX/Unicode and LyX can be used with XeLaTeX wiki.lyx.org/LyX/XeTeX and therefore should be able to handle utf8 files. If your original document was not UTF-8 encoded, then simply adding the \usepackage[utf8]{inputenc} will not work. You need to re-save the file as UTF-8 encoded for inputenc (or XeLateX) to do its work. In LyX it appears you do this by specifying this in the Document menu. But remember, surely if you implement this, you will not be running LyX from the cgi. –  Alan Munn Jan 11 '11 at 2:15
@Dave: I don't know enough about LyX to help you on this, but it's likely that you're doing something wrong. If your file wan't UTF-8 before, it's unlikely it has characters that can't be expressed when you change it to UTF-8, so I suspect that you (or LyX) hasn't actually re-encoded the file. –  Alan Munn Jan 11 '11 at 2:36
Easier than stripping backslashes from the input is to change the category code of the backslash to something harmless while reading user input. –  Harald Hanche-Olsen Jan 11 '11 at 13:36