WYSIWYG editor returning &gt; instead <

[David Lozzi]

Howdy,

I'm using a WYSIWYG editor called TinyMCE. When I edit some text and then
save it back to my SQL server using a SQLCommand, all HTML characters are
changed to HTML code, i.e. &gt;strong&lt; instead of <strong> and so on. Is
this a problem with the editor or something else? Does .Net convert it? I
had to disable page validate request because of the tags, is there more?

Thanks,

--
David Lozzi
Web Applications Developer
dlozzi@(remove-this)delphi-ts.com

[Steven Cheng[MSFT]]

Hi David,

Welcome to ASPNET newsgroup.
Regarding on the HTML editor html text processing question, here are some
of my understanding and suggestion:

1. As for those WYSIWYG html editors , they should directly provide the
property to let us access the raw HTML value (edited at client) when being
postback to server... Also, we need to turn off asp.net page's
validateRequest first...... You can debug through the code in IDE to
explore the text provided by the 3rd party html editor you used to verify
this...

2. As for SqlCommand , it'll directly inserted the string parameter we
provided in sqlcommand's statement or parameter, there won't have any
automatic htmlencoding, we can verify the data stored in sqlserver through
the query analyzer.....

In addition, some html editor will provide a property like "EncodedHtml"
which is the value of the html which has been html encoded.... So I'd
suggest you verify the about things to see at what step is the raw HTML
value being converted by html encoding...

If there're anything unclear, please feel free to post here.

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)



--------------------
| From: "David Lozzi" <Da********@nospam.nospam>
| Subject: WYSIWYG editor returning &gt; instead <
| Date: Thu, 1 Dec 2005 15:13:22 -0500
| Lines: 18
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
| X-RFC2646: Format=Flowed; Original
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
| Message-ID: <ec**************@TK2MSFTNGP12.phx.gbl>
| Newsgroups: microsoft.public.dotnet.framework.aspnet
| NNTP-Posting-Host: c-24-63-42-200.hsd1.ma.comcast.net 24.63.42.200
| Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFT NGP12.phx.gbl
| Xref: TK2MSFTNGXA02.phx.gbl
microsoft.public.dotnet.framework.aspnet:362150
| X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet
|
| Howdy,
|
| I'm using a WYSIWYG editor called TinyMCE. When I edit some text and then
| save it back to my SQL server using a SQLCommand, all HTML characters are
| changed to HTML code, i.e. &gt;strong&lt; instead of <strong> and so on.
Is
| this a problem with the editor or something else? Does .Net convert it? I
| had to disable page validate request because of the tags, is there more?
|
| Thanks,
|
| --
| David Lozzi
| Web Applications Developer
| dlozzi@(remove-this)delphi-ts.com
|
|
|
|
|

[Steven Cheng[MSFT]]

Hi David,

Does my last reply helps a little? If there're anything else we can help,
please feel free to post here.

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

--------------------
| X-Tomcat-ID: 90707638
| References: <ec**************@TK2MSFTNGP12.phx.gbl>
| MIME-Version: 1.0
| Content-Type: text/plain
| Content-Transfer-Encoding: 7bit
| From: st*****@online.microsoft.com (Steven Cheng[MSFT])
| Organization: Microsoft
| Date: Fri, 02 Dec 2005 04:49:20 GMT
| Subject: RE: WYSIWYG editor returning &gt; instead <
| X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet
| Message-ID: <8W**************@TK2MSFTNGXA02.phx.gbl>
| Newsgroups: microsoft.public.dotnet.framework.aspnet
| Lines: 66
| Path: TK2MSFTNGXA02.phx.gbl
| Xref: TK2MSFTNGXA02.phx.gbl
microsoft.public.dotnet.framework.aspnet:362240
| NNTP-Posting-Host: tomcatimport2.phx.gbl 10.201.218.182
|
| Hi David,
|
| Welcome to ASPNET newsgroup.
| Regarding on the HTML editor html text processing question, here are some
| of my understanding and suggestion:
|
| 1. As for those WYSIWYG html editors , they should directly provide the
| property to let us access the raw HTML value (edited at client) when
being
| postback to server... Also, we need to turn off asp.net page's
| validateRequest first...... You can debug through the code in IDE to
| explore the text provided by the 3rd party html editor you used to verify
| this...
|
| 2. As for SqlCommand , it'll directly inserted the string parameter we
| provided in sqlcommand's statement or parameter, there won't have any
| automatic htmlencoding, we can verify the data stored in sqlserver
through
| the query analyzer.....
|
| In addition, some html editor will provide a property like "EncodedHtml"
| which is the value of the html which has been html encoded.... So I'd
| suggest you verify the about things to see at what step is the raw HTML
| value being converted by html encoding...
|
| If there're anything unclear, please feel free to post here.
|
| Regards,
|
| Steven Cheng
| Microsoft Online Support
|
| Get Secure! www.microsoft.com/security
| (This posting is provided "AS IS", with no warranties, and confers no
| rights.)
|
|
|
|
|
|
|
| --------------------
| | From: "David Lozzi" <Da********@nospam.nospam>
| | Subject: WYSIWYG editor returning &gt; instead <
| | Date: Thu, 1 Dec 2005 15:13:22 -0500
| | Lines: 18
| | X-Priority: 3
| | X-MSMail-Priority: Normal
| | X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
| | X-RFC2646: Format=Flowed; Original
| | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
| | Message-ID: <ec**************@TK2MSFTNGP12.phx.gbl>
| | Newsgroups: microsoft.public.dotnet.framework.aspnet
| | NNTP-Posting-Host: c-24-63-42-200.hsd1.ma.comcast.net 24.63.42.200
| | Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFT NGP12.phx.gbl
| | Xref: TK2MSFTNGXA02.phx.gbl
| microsoft.public.dotnet.framework.aspnet:362150
| | X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet
| |
| | Howdy,
| |
| | I'm using a WYSIWYG editor called TinyMCE. When I edit some text and
then
| | save it back to my SQL server using a SQLCommand, all HTML characters
are
| | changed to HTML code, i.e. &gt;strong&lt; instead of <strong> and so
on.
| Is
| | this a problem with the editor or something else? Does .Net convert it?
I
| | had to disable page validate request because of the tags, is there more?
| |
| | Thanks,
| |
| | --
| | David Lozzi
| | Web Applications Developer
| | dlozzi@(remove-this)delphi-ts.com
| |
| |
| |
| |
| |
|
|

[David Lozzi]

It appears not to have anything to do with the SQL command. I am currently
just working with a file. My script opens the file and reads the html
between two tags <editArea> and </editArea>. The HTML between the two is
then loaded into the WYSIWIG editor and looks great!. When I click Save, it
writes back to the file with the incorrect text Instead of an > it writes
&gt; and <, &lt;.

If I set the save button to only load the data from the editor into another
plain non-rtf textarea everything looks good. the > are > and < are <. I
just tried to load the text file from the second textarea independant of the
WYSIWYG editor and all of the < > are still converting to &lt; &gt;. This
seems to be independant of the editor? My code is below to open the file,
maybe something there?

I typed in the following into my textarea:
<b>this is a test</b><br>

And got this on my HTML page:
<b>this is a test</b><br>

If I put this directly into the .Write() like below, it works correctly. I
see a bold sentence.
win.Write("<b>this is a test</b><br>")

Dim path As String = Server.MapPath("tester.aspx")

Dim din As New StreamReader(IO.File.OpenRead(path))

Dim conts As String = din.ReadToEnd

din.Close()

Dim start As String = Left(conts, InStr(conts, "<editArea>") + 9)

Dim midd As String = Textarea1.Value

Dim endf As String = Right(conts, Len(conts) - InStr(conts, "</editArea>") +
1)

Dim win As New StreamWriter(IO.File.OpenWrite(path))

win.Write(start & midd & endf)

win.Close()

--
David Lozzi
Web Applications Developer
dlozzi@(remove-this)delphi-ts.com

"Steven Cheng[MSFT]" <st*****@online.microsoft.com> wrote in message
news:8W**************@TK2MSFTNGXA02.phx.gbl...

Hi David,

Welcome to ASPNET newsgroup.
Regarding on the HTML editor html text processing question, here are some
of my understanding and suggestion:

1. As for those WYSIWYG html editors , they should directly provide the
property to let us access the raw HTML value (edited at client) when being
postback to server... Also, we need to turn off asp.net page's
validateRequest first...... You can debug through the code in IDE to
explore the text provided by the 3rd party html editor you used to verify
this...

2. As for SqlCommand , it'll directly inserted the string parameter we
provided in sqlcommand's statement or parameter, there won't have any
automatic htmlencoding, we can verify the data stored in sqlserver through
the query analyzer.....

In addition, some html editor will provide a property like "EncodedHtml"
which is the value of the html which has been html encoded.... So I'd
suggest you verify the about things to see at what step is the raw HTML
value being converted by html encoding...

If there're anything unclear, please feel free to post here.

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)



--------------------
| From: "David Lozzi" <Da********@nospam.nospam>
| Subject: WYSIWYG editor returning &gt; instead <
| Date: Thu, 1 Dec 2005 15:13:22 -0500
| Lines: 18
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2900.2670
| X-RFC2646: Format=Flowed; Original
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670
| Message-ID: <ec**************@TK2MSFTNGP12.phx.gbl>
| Newsgroups: microsoft.public.dotnet.framework.aspnet
| NNTP-Posting-Host: c-24-63-42-200.hsd1.ma.comcast.net 24.63.42.200
| Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFT NGP12.phx.gbl
| Xref: TK2MSFTNGXA02.phx.gbl
microsoft.public.dotnet.framework.aspnet:362150
| X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet
|
| Howdy,
|
| I'm using a WYSIWYG editor called TinyMCE. When I edit some text and
then
| save it back to my SQL server using a SQLCommand, all HTML characters
are
| changed to HTML code, i.e. &gt;strong&lt; instead of <strong> and so on.
Is
| this a problem with the editor or something else? Does .Net convert it?
I
| had to disable page validate request because of the tags, is there more?
|
| Thanks,
|
| --
| David Lozzi
| Web Applications Developer
| dlozzi@(remove-this)delphi-ts.com
|
|
|
|
|

[tdavisjr]

I think the behavior is by design and it is a good practice. You don't
want end users inserting < > into your database to read back out to
your aspx pages since they can insert a <script> block and execute some
javascript when you display this text from the database.

What needs to happen is that when you get the data out of the database
you pass it as a parameter to the HttpUtility.Server.HtmlDecode(your
data). This would convert it from &lt; to < .

Also, if you really want to save the < > in the database then you can
use the same static method to decode the &lt; &gt; before its inserted
into the database.

I hope things are much clearer now.