Encoding/Decoding using ESAPI

Question

I am trying to prevent CRLF injection(in a url having few user inputs) and trying to encode the user input present in URL. I know I can use input-validation too but if I use ESAPI encoder, does it have any corresponding decoder? If it has then what it is? If not then what can be done to perform the same encoding and decoding?

Answer 1

As you alluded to, this is a task for the input validation. The ESAPI encoders do output encoding. There are no corresponding decoders because the decoding process (to render it as safe HTML) is done via the end user's browsers.