Web Agent Guides › Web Agent Configuration Guide › Enforce Security with URL Monitoring › Specify Bad Form Characters

Specify Bad Form Characters

The bracket, ampersand, and quotation characters, <, >, &, " are commonly used in cross-site scripting attacks. The BadFormChars parameter specifies which of these characters the Web Agent should encode as literal HTML characters before outputting them to an HTML form. The encoding allows the intentional use of scripting code for presenting forms for an authentication challenge.

There are only four valid characters for this setting, which are all set by default: <, >, &, ". Adding characters other than these four has no effect.

Note: The quotation mark (") must be entered as %22, the hexidecimal equivalent of the ASCII character.

If your application uses custom forms and you want these characters to remain unencoded in raw HTML, leave the BadFormsChars parameter blank or set it as follows:

Note: There are no spaces between the opening and closing quotes and the value the quotes enclose.

Only directive substitutions are encoded as raw HTML—the source lines in the form template, such as login.fcc are unchanged. Keeping the source lines unchanged prevents dynamic data containing scripting code from being sent back to the browser as data in the form.