Javascript variable contains plain text including html tag

Question

this is the js code

function startChatSession(){  
$.ajax({
  url: "chat.php?action=startchatsession",
  cache: false,
  dataType: "json",
  success: function(data) {

    username = data.username;

    $.each(data.items, function(i,item){
        if (item)   { // fix strange ie bug

            chatboxtitle = item.f;

            if ($("#chatbox_"+chatboxtitle).length <= 0) {
                createChatBox(chatboxtitle,1);
            }

            if (item.s == 1) {
                item.f = username;
            }

            if (item.s == 2) {
                $("#chatbox_"+chatboxtitle+" .chatboxcontent").append('<div class="chatboxmessage"><span class="chatboxinfo">'+item.m+'</span></div>');
            } else {
                $("#chatbox_"+chatboxtitle+" .chatboxcontent").append('<div class="chatboxmessage"><span class="chatboxmessagefrom">'+item.f+':&nbsp;&nbsp;</span><span class="chatboxmessagecontent">'+item.m+'</span></div>');
            }
        }
    });

here +item.m+ holds a plain text

if it contains html tags then it returns html tags also

for example +item.m+ contains

<b>Hello</b>

i want output to be

Hello

but i am getting same output as

<b>Hello</b>

this code is implemented in a IM chat and i need html code to be executed in the chat window. . .so please help me by suggesting to get html execution here

Thank you

It looks like `item.m` is probably using HTML entities rather than literal `<` and `>` characters. — crush, Jan 23 '14 at 19:53
The HTML tags in `item.m` must be encoded using htmlentities or something like that. Therefore, they don't get interpreted by the browser as HTML tags. — Fabien Warniez, Jan 23 '14 at 19:53
Check if the output is html -encoded, e.g. it's actually `<b>Hello...`. — Marc B, Jan 23 '14 at 19:54

score 1 · Answer 1 · answered Jan 23 '14 at 19:55

1

On the PHP side, don't use htmlentities() to encode the content that you return. When you do, the server returns the HTML code of the character < and >, respectively < and >.

answered Jan 23 '14 at 19:55

Fabien Warniez

2,731
1
21
30

on php side i have $chat['message'] = sanitize($chat['message']); , what it means – ManojGeek Jan 23 '14 at 20:00
sanitize is function defined in your code, check what it does. I bet you anything it calls htmlentities() – Fabien Warniez Jan 23 '14 at 20:02
sorry, i have found function sanitize($text) { $text = htmlspecialchars($text, ENT_QUOTES); $text = str_replace("\n\r","\n",$text); $text = str_replace("\r\n","\n",$text); $text = str_replace("\n","
",$text); } this function – ManojGeek Jan 23 '14 at 20:08
htmlspecialchars is what is encoding your HTML characters. Try removing it. – Fabien Warniez Jan 23 '14 at 20:11
removing it stopped loading messages :( – ManojGeek Jan 23 '14 at 20:19
Then you might want to try this: http://stackoverflow.com/questions/1912501/unescape-html-entities-in-javascript – Fabien Warniez Jan 23 '14 at 21:30

score 1 · Answer 2 · answered Jan 23 '14 at 19:55

1

It seems that you are receiving encoded text from your server. Trying applying unescape() on your string before concatenating your strings.

answered Jan 23 '14 at 19:55

Mabedan

857
8
30

Mehran Hatami · Accepted Answer · 2014-01-23T20:58:39.633

1

it seems you have <b&gt instead of a real <br>, to fix it do this:

var itemText = item.m
    .replace(/&lt;b&gt;/g, '<b>')
    .replace(/&lt;\/b&gt;/g, '</b>');

then use itemText instead of item.m in the code, like this:

        var itemText = item.m
            .replace(/&lt;b&gt;/g, '<b>')
            .replace(/&lt;\/b&gt;/g, '</b>'); 
        if (item.s == 2) {
            $("#chatbox_"+chatboxtitle+" .chatboxcontent").append('<div class="chatboxmessage"><span class="chatboxinfo">'+itemText+'</span></div>');
        } else {
            $("#chatbox_"+chatboxtitle+" .chatboxcontent").append('<div class="chatboxmessage"><span class="chatboxmessagefrom">'+item.f+':&nbsp;&nbsp;</span><span class="chatboxmessagecontent">'+itemText+'</span></div>');
        }

and if you want to do it for some other tags like this:

<a href="chat.php">Hello</a>

you can do this like:

var itemText = item.m
    .replace(/&lt;\/a&gt;/g, '</a>')
    .replace(/&lt;a/g, '<a')
    .replace(/&gt;/g, '>');

edited Jan 23 '14 at 20:58

answered Jan 23 '14 at 19:58

Mehran Hatami

12,723
6
28
35

can u please tell what would be the replace code for Hello , Thanks – ManojGeek Jan 23 '14 at 20:51
@Raj: I updated my answer for `Hello`. – Mehran Hatami Jan 23 '14 at 20:59
and what about double quotes?? – ManojGeek Jan 23 '14 at 21:00
double quotes usually don't change, `Hello` is like `<a href="chat.php">Hello</a>` and the only problems are `<` and `>`. – Mehran Hatami Jan 23 '14 at 21:09

alejandro · Answer 4 · 2014-01-23T20:16:37.237

1

Decode the HTML entities , using .html jQuery function decodes the entities

item.m = $('<div>').html(item.m).text();

but I recommend you to remove the entities on server side, I see you are developing a chat so you better remove any HTML tags for security concerns not sure how are you working with the messages but users sometimes can do cross site scripting.

edited Jan 23 '14 at 20:16

answered Jan 23 '14 at 20:08

alejandro

2,799
1
17
25

Javascript variable contains plain text including html tag

4 Answers4