About security issues: UTF8

[d3j4vu]

Hello everybody, this is my first post. Hope to learn a lot here.

Reading the book "Introducing HTML 5" from B. Lawson and R. Sharp, starting Chapter I, it states: "Then we need to define the document's character encoding. Not doing so can result in an obscure but real security risk (see http://code.google.com/p/doctype/wiki/ArticleUtf7). This should be in the first 512 bytes of the document. Unless you can think of a splendid reason not to use it, we recommend UTF-8 as the character encoding."

Being a the curious person I am, i quickly went to that URL mentioned, just to undertsand what are those security concerns. But Google doesn't like me. It throws me out with a "You are not authorized to blablabla...". So, i ended here, and I want to ask you guys, what are those potential security issues when encoding is not defined?

Regards,

d3j4vu.

[zcorpan]

http://code.google.com/p/doctype-mirror ... rticleUtf7