why use htmlencode

Discussion in 'ASP General' started by diablo, Jul 7, 2005.

  1. diablo

    diablo Guest

    Hi

    I have a website where people can enter comments into a textarea - some of
    these may have a bit of html - like links - or <blockquote>

    the comments are stored in a Access2000 mdb file - A friend told me that i
    have to use htmlencode on the textarea string before storing it in the
    database. but it seems to work fine without doing this - is there any reason
    as to why i should put it thru htmlencode?

    when the comments are displayed they are written straight into a <div>

    <div><%=recset.fields("comments")%></div>

    thanks in advance

    Diablo
     
    diablo, Jul 7, 2005
    #1
    1. Advertising

  2. No, IMHO you should use HTMLEncode when placing it INTO the textarea (e.g.
    for edit) and when displaying if you don't want any of the HTML to actually
    render as intended. Again, IMHO, it should be stored as entered, and only
    converted when displaying. I'd be curious about your friend's reason(s)
    about having to store it in HTMLEncoded format.




    "diablo" <> wrote in message
    news:cGeze.2080$...
    > Hi
    >
    > I have a website where people can enter comments into a textarea - some of
    > these may have a bit of html - like links - or <blockquote>
    >
    > the comments are stored in a Access2000 mdb file - A friend told me that i
    > have to use htmlencode on the textarea string before storing it in the
    > database. but it seems to work fine without doing this - is there any
    > reason
    > as to why i should put it thru htmlencode?
    >
    > when the comments are displayed they are written straight into a <div>
    >
    > <div><%=recset.fields("comments")%></div>
    >
    > thanks in advance
    >
    > Diablo
    >
    >
    >
     
    Aaron Bertrand [SQL Server MVP], Jul 7, 2005
    #2
    1. Advertising

  3. diablo

    diablo Guest


    > when displaying if you don't want any of the HTML to actually
    > render as intended. Again, IMHO, it should be stored as entered,


    I am a simple soul and may have misinterpreted my friends advice - but what
    you are saying is that, ignoring the case of editing, I do not need to use
    htmlencode?

    I found this tip

    http://www.devx.com/tips/Tip/13459

    but i guess i can ignore it since if i store raw html in the db then i wont
    have

    &amp;

    type characters in my DB.

    Is my thinking correct?


    > and only
    > converted when displaying.


    Here you mean displaying for editing not for rendering dont you?

    TIA

    D
     
    diablo, Jul 8, 2005
    #3
  4. > if i store raw html in the db then i wont have
    >
    > &amp;
    >
    > type characters in my DB.


    Correct. It will just be &

    > > and only
    > > converted when displaying.

    >
    > Here you mean displaying for editing not for rendering dont you?


    No, I meant what I said. You trimmed some of it, but it *needs* to be
    converted before being inserted into a textarea for editing. How you want
    to handle rendering is up to you.

    Do you want <a href=foo>link</a> to look exactly as it does in this message?
    Then HTMLEncode it.

    Do you want <a href=foo>link</a> to work as an active link when rendered?
    Then do not HTMLEncode it.
     
    Aaron Bertrand [SQL Server MVP], Jul 8, 2005
    #4
  5. diablo

    diablo Guest


    > No, I meant what I said. You trimmed some of it, but it *needs* to be
    > converted before being inserted into a textarea for editing. How you want
    > to handle rendering is up to you.
    >
    > Do you want <a href=foo>link</a> to look exactly as it does in this

    message?
    > Then HTMLEncode it.
    >
    > Do you want <a href=foo>link</a> to work as an active link when rendered?
    > Then do not HTMLEncode it.
    >

    Ah... penny has dropped.

    Thanks for your help

    D
     
    diablo, Jul 8, 2005
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Makarand
    Replies:
    0
    Views:
    1,004
    Makarand
    Nov 6, 2003
  2. Versteijn
    Replies:
    0
    Views:
    522
    Versteijn
    Oct 23, 2004
  3. diablo
    Replies:
    0
    Views:
    476
    diablo
    Jun 26, 2005
  4. Mr. SweatyFinger
    Replies:
    2
    Views:
    2,072
    Smokey Grindel
    Dec 2, 2006
  5. Hraklhs

    Always use Server.HTMLEncode?

    Hraklhs, Jan 7, 2004, in forum: ASP General
    Replies:
    0
    Views:
    147
    Hraklhs
    Jan 7, 2004
Loading...

Share This Page