Web Wiz - Green Windows Web Hosting

  New Posts New Posts RSS Feed - Restrict javascript usage in RTE
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Forum LockedRestrict javascript usage in RTE

 Post Reply Post Reply
Author
kansaiben View Drop Down
Newbie
Newbie


Joined: 17 August 2009
Status: Offline
Points: 3
Post Options Post Options   Thanks (0) Thanks(0)   Quote kansaiben Quote  Post ReplyReply Direct Link To This Post Topic: Restrict javascript usage in RTE
    Posted: 17 August 2009 at 7:42pm
I use the RTE in an event calendar using ASP where a user can add and edit events. I don't want users adding malicious code to the system so am trying to limit the use of javascript. Having a strange problem though. When a user types the following in the RTE text area (not HTML view):
<script type="text/javascript">alert("I am an alert box!");</script>
it is converted by the RTE to:
&lt;script type="text/javascript"&gt;alert("I am an alert box!");&lt;/script&gt;
when entered in the data base.

Should a user choose to edit this entry, they use another page where the previously entered values in the database are used to populate the form elements, the RTE text area included. So for example, the text area uses code like this:
<textarea cols="65" rows="33" name="exampleEventDescription" id="exampleEventDescription"><%=(exampleRS.Fields.Item("exampleEventDescription").Value)%></textarea>

when I do this though, the text area entry gets converted back to:
<script type="text/javascript">alert("I am an alert box!");</script>
and the alert box pops up.

I can't figure out how to stop this from happening. Any help?
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 18 August 2009 at 9:35am
Try using the following:-

<textarea cols="65" rows="33" name="exampleEventDescription" id="exampleEventDescription"><% = HTMLencode((exampleRS.Fields.Item("exampleEventDescription").Value)) %></textarea>
Back to Top
kansaiben View Drop Down
Newbie
Newbie


Joined: 17 August 2009
Status: Offline
Points: 3
Post Options Post Options   Thanks (0) Thanks(0)   Quote kansaiben Quote  Post ReplyReply Direct Link To This Post Posted: 18 August 2009 at 5:07pm
Cheers, that really helped. I did have to modify the syntax just a bit to get it to work, but saved me from pulling all my hair out.

<textarea cols="65" rows="33" name="exampleEventDescription" id="exampleEventDescription"><% = Server.HTMLEncode((exampleRS.Fields.Item("exampleEventDescription").Value)) %></textarea>
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.


Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.