vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vB3 Programming Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=15)
-   -   Ajax - Edit-in-place prob ( html ) (https://vborg.vbsupport.ru/showthread.php?t=184078)

Mixtoon 07-01-2008 01:22 PM
Ajax - Edit-in-place prob ( html )
 
Hi,

I have a code which helps me to edit a text and save it to database.

the files I have:

articles.html

PHP Code:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<script type="text/javascript" src="prototype.js"></script>

<script type="text/javascript">

    function init()
    {
        Event.observe("edit", "click", function(e){ edit_in_place() });

        Event.observe("save", "click", function(e){ save() });

        Event.observe("cancel", "click", function(e){ cancel() });
    }

    function edit_in_place()
    {
        $("save_settings").style.display = "inline";

        $("edit_settings").style.display = "none";

        var article_title = '<input type="text" name="article_title" id="article_title"';
        article_title += 'size="30" value="'+$("title").innerHTML+'" >';
        
        $("title").innerHTML = article_title;
        


    }
    
    function save()
    {
        new Ajax.Request("articles.php", 
            {
                method: "post",
                postBody: "title="+$F("article_title")+
                "&uid=1"+"&save="+$F("save"),
                onComplete: show 
            }
        );
    }

    function show(res)
    {
        $("title").innerHTML = $("article_title").value;
        $("save_settings").style.display = "none";
        $("edit_settings").style.display = "inline";
    }

    function cancel()
    {
        $("title").innerHTML = "Edit the article title here...";
        $("save_settings").style.display = "none";
        $("edit_settings").style.display = "inline";
    }

</script>

</head>

<body onload="init()">
    <div>Title:</div>
    <span id="title">
        Edit the article title here...
    </span>
    
    <span id="edit_settings">
        <input type="button" id="edit" name="edit" value="edit" >        
    </span>
    
    <span id="save_settings" style="display:none">
        <input type="button" id="save" name="save" value="save">&nbsp;
        <input type="button" id="cancel" name="cancel" value="cancel">
    </span>
</body>

</html> 


prototype.js





and articles.php which conatin the orders to save the text in the database.




the problem is I don't want any body to enter html code,


I mean if some one edit the text and write:

<b>test</b>

it should give him this:
<b>test</b>


and NOT:
test



so how to do that? :confused:

MoT3rror 07-01-2008 06:38 PM
http://www.php.net/htmlspecialchars
Or
http://www.php.net/manual/en/function.htmlentities.php

Mixtoon 07-02-2008 02:24 AM
Thanks MoT3rror,

but this is for the php file.

I need it for the javascript!

--------------- Added [DATE]1214975648[/DATE] at [TIME]1214975648[/TIME] ---------------

ok I know I should use escapeHTML()

but how to add that to this code?

Code:
<script type="text/javascript">

    function init()
    {
        Event.observe("edit", "click", function(e){ edit_in_place() });

        Event.observe("save", "click", function(e){ save() });

        Event.observe("cancel", "click", function(e){ cancel() });
    }

    function edit_in_place()
    {
        $("save_settings").style.display = "inline";

        $("edit_settings").style.display = "none";

        var article_title = '<input type="text" name="article_title" id="article_title"';
        article_title += 'size="30" value="'+$("title").innerHTML+'" >';
       
        $("title").innerHTML = article_title;
       


    }
   
    function save()
    {
        new Ajax.Request("articles.php", 
            {
                method: "post",
                postBody: "title="+$F("article_title")+
                "&uid=1"+"&save="+$F("save"),
                onComplete: show 
            }
        );
    }

    function show(res)
    {
        $("title").innerHTML = $("article_title").value;
        $("save_settings").style.display = "none";
        $("edit_settings").style.display = "inline";
    }

    function cancel()
    {
        $("title").innerHTML = "Edit the article title here...";
        $("save_settings").style.display = "none";
        $("edit_settings").style.display = "inline";
    }

</script>

Dismounted 07-02-2008 05:22 AM
You should ALWAYS sanitize data server-side. That means, you should run htmlspecialchars() in your PHP script. Sanitizing client-side (ie. with Javascript) can be easily bypassed.


All times are GMT. The time now is 07:39 AM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01717 seconds
  • Memory Usage 1,755KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)bbcode_code_printable
  • (1)bbcode_php_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (4)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete