why use htmlencode

[diablo]

Hi

I have a website where people can enter comments into a textarea - some of
these may have a bit of html - like links - or <blockquote>

the comments are stored in a Access2000 mdb file - A friend told me that i
have to use htmlencode on the textarea string before storing it in the
database. but it seems to work fine without doing this - is there any reason
as to why i should put it thru htmlencode?

when the comments are displayed they are written straight into a <div>

<div><%=recset.fields("comments")%></div>

thanks in advance

Diablo

 

[Aaron Bertrand [SQL Server MVP]]

No, IMHO you should use HTMLEncode when placing it INTO the textarea (e.g.
for edit) and when displaying if you don't want any of the HTML to actually
render as intended. Again, IMHO, it should be stored as entered, and only
converted when displaying. I'd be curious about your friend's reason(s)
about having to store it in HTMLEncoded format.

 

[diablo]

when displaying if you don't want any of the HTML to actually
render as intended. Again, IMHO, it should be stored as entered,

I am a simple soul and may have misinterpreted my friends advice - but what
you are saying is that, ignoring the case of editing, I do not need to use
htmlencode?

I found this tip

http://www.devx.com/tips/Tip/13459

but i guess i can ignore it since if i store raw html in the db then i wont
have

&amp;

type characters in my DB.

Is my thinking correct?

and only
converted when displaying.

Here you mean displaying for editing not for rendering dont you?

TIA

D

 

[Aaron Bertrand [SQL Server MVP]]

if i store raw html in the db then i wont have

&amp;

type characters in my DB.

Correct. It will just be &

Here you mean displaying for editing not for rendering dont you?

No, I meant what I said. You trimmed some of it, but it *needs* to be
converted before being inserted into a textarea for editing. How you want
to handle rendering is up to you.

Do you want <a href=foo>link</a> to look exactly as it does in this message?
Then HTMLEncode it.

Do you want <a href=foo>link</a> to work as an active link when rendered?
Then do not HTMLEncode it.

 

[diablo]

No, I meant what I said. You trimmed some of it, but it *needs* to be
converted before being inserted into a textarea for editing. How you want
to handle rendering is up to you.

Do you want <a href=foo>link</a> to look exactly as it does in this message?
Then HTMLEncode it.

Do you want <a href=foo>link</a> to work as an active link when rendered?
Then do not HTMLEncode it.

Ah... penny has dropped.

Thanks for your help

D