dom - Why is the html attribute returned as 'htmldecoded' even if encoded in html source? -
I use the html attribute title to set some symbols like this:
& lt; A href ... title = "navigate to the next chapter" & gt; Go & lt; / A & gt; Then the jquery plugin goes through all the [title] attributes and creates beautiful tooltips.
& lt; Div style = "status: absolute ..." & gt; Go to next chapter & lt; / Div & gt; The problem is, that the title is editable by the user, so he can write whatever he wants. I first thought that HTML encoding is ok, but it turns out that I was wrong. If I have & lt; An id = "a" title = "& transliteration; warning (10); gt; & gt; Go & lt; / A & gt;
Then the tooltip div looks like this:
& lt; Div style = "status: complete ..." & gt; & Lt; Script & gt; Alert (10) & lt; / Script & gt; & Lt; / Div & gt;
1) Browser asks value, so why does it decode properties of the title?
2) And how can I solve it? (I know that a solution is double HTML encoding, but it is frightening)
How to test it: Consider this code
& lt; Html & gt; & Lt; Body & gt; & Lt ;! - Once encoding, it does not work - & gt; & Lt; An id = "a" title = "& lift; script & gt; alert (10); lift; / script & gt" & gt; Attille & lt; / A & gt; & Lt ;! - Encoding twice, it works - & gt; & Lt; An id = "b" title = "& amp; lift; script & amp; gt; alert (10); amp; lift; / script & gt; byteleil & lt; / a & Gt; & lt; script & gt; function w (x) {document.write (x.attributes ["title"]. Value);} w (a); // shows warnings w (b); // The attribute value is the decoded value - this is the only way to understand if you are about to & lt; / script & gt; & lt; / body & gt; & lt; / html & gt; 1) If you set a javascript value for "\ n", then alert it, do you " \ N "or want to get a real Newline back? The headline is the text of the feature ... You have to convert it to HTML-encoded words. 2) You can double-encode it Change, or you can use a text node:
var node = document.createTextNode (x.attributes ['title']. Value); document.appendChild (node) ;
This is the preferred way, then the spider / non-javascript browser will see the correct title attribute.
Comments
Post a Comment