does auto-encode inner html?</a></h1> </div> <div class="grid fw-wrap pb8 mb16 bb bc-black-075"> <div class="grid--cell ws-nowrap mr16 mb8" title="2016-01-12 19:07:53Z"> <span class="fc-light mr2">Asked</span> <time itemprop="dateCreated" datetime="2011-11-18T16:12:01.607" class="fromnow">Nov 18 '11 at 16:12</time> </div> <div class="grid--cell ws-nowrap mr16 mb8"> <span class="fc-light mr2">Active</span> <time class="fromnow" title="2012-10-31T22:19:25.687" datetime="2012-10-31T22:19:25.687">Oct 31 '12 at 22:19</a> </div> <div class="grid--cell ws-nowrap mb8" title="Viewed 1,638 times"> <span class="fc-light mr2">Viewed</span> 1,638 times </div> </div> <div id="mainbar" role="main" aria-label="questions and answers"> <div id="question" class="question" data-questionid="8185397" data-ownerid="1054151" data-score="7"> <div class="post-layout"> <div class="votecell post-layout--left"> <div class="js-voting-container grid jc-center fd-column ai-stretch gs4 fc-black-200" data-post-id="8185397"> <button class="js-vote-up-btn grid--cell s-btn s-btnunset c-pointer"><svg aria-hidden="true" class="m0 svg-icon iconArrowUpLg" width="36" height="36" viewBox="0 0 36 36"><path d="M2 26h32L18 10 2 26z"></path></svg></button> <div class="js-vote-count grid--cell fc-black-500 fs-title grid fd-column ai-center" itemprop="upvoteCount" data-value="7">7</div> <button class="js-bookmark-btn s-btn s-btnunset c-pointer py4"> <svg aria-hidden="true" class="svg-icon iconBookmark" width="18" height="18" viewBox="0 0 18 18"><path d="M6 1a2 2 0 00-2 2v14l5-4 5 4V3a2 2 0 00-2-2H6zm3.9 3.83h2.9l-2.35 1.7.9 2.77L9 7.59l-2.35 1.7.9-2.76-2.35-1.7h2.9L9 2.06l.9 2.77z"></path></svg> <div class="js-bookmark-count mt4" data-value=""></div> </button> </div> </div> <div class="postcell post-layout--right"> <div class="s-prose js-post-body" itemprop="text"><p>I was trying to print some text between <code><textarea></code> and <code></textarea></code> tags, but I've noticed that if I input some characters like <code><</code> and <code>></code>, textarea automatically converts them to <code><</code> and <code>></code>.</p> <p>Example:</p> <p><code><textarea><script></textarea></code> </p> <p>will produce this HTML </p> <p><code><textarea><script></textarea></code></p> <p>Can you explain me why this happens?</p> <p>Thanks in advance, any help is appreciated, best regards.</p></div> <div class="mt24 mb12"> <div class="post-taglist grid gs4 gsy fd-column"> <div class="grid ps-relative"> <a href="../../questions/tagged/html" class="post-tag js-gps-track" title="show questions tagged 'html'" rel="tag">html</a> <a href="../../questions/tagged/textarea" class="post-tag js-gps-track" title="show questions tagged 'textarea'" rel="tag">textarea</a> </div> </div> </div> <div class="mb0"> <div class="mt16 grid gs8 gsy fw-wrap jc-end ai-start pt4 mb16"> <div class="grid--cell mr16 fl1 w96"></div> <div class="post-signature grid--cell"> <div class="s-user-card s-user-card"> <time class="s-user-card--time" datetime="edited Oct 31 '12 at 22:18">edited Oct 31 '12 at 22:18</time> <a href="../../users/632088/rusty-rob" class="s-avatar s-avatar32 s-user-card--avatar"> <img class="s-avatar--image" src="../../users/profiles/632088.webp" data-jdenticon-width="32" data-jdenticon-height="32" data-jdenticon-value="Rusty Rob" /> </a> <div class="s-user-card--info"> <a href="../../users/632088/rusty-rob" class="s-user-card--link">Rusty Rob</a> <ul class="s-user-card--awards"> <li class="s-user-card--rep" title="reputation score">16,489</li> <li class="s-award-bling s-award-blinggold" title="8 gold badges">8</li> <li class="s-award-bling s-award-blingsilver" title="100 silver badges">100</li> <li class="s-award-bling s-award-blingbronze" title="116 bronze badges">116</li> </ul> </div> </div> </div> <div class="post-signature owner grid--cell"> <div class="s-user-card s-user-card"> <time class="s-user-card--time" datetime="asked Nov 18 '11 at 16:12">asked Nov 18 '11 at 16:12</time> <a href="../../users/1054151/benderr" class="s-avatar s-avatar32 s-user-card--avatar"> <img class="s-avatar--image" src="../../users/profiles/1054151.webp" data-jdenticon-width="32" data-jdenticon-height="32" data-jdenticon-value="BeNdErR" /> </a> <div class="s-user-card--info"> <a href="../../users/1054151/benderr" class="s-user-card--link">BeNdErR</a> <ul class="s-user-card--awards"> <li class="s-user-card--rep" title="reputation score">17,471</li> <li class="s-award-bling s-award-blinggold" title="21 gold badges">21</li> <li class="s-award-bling s-award-blingsilver" title="72 silver badges">72</li> <li class="s-award-bling s-award-blingbronze" title="103 bronze badges">103</li> </ul> </div> </div> </div> </div> </div> </div> <div class="post-layout--right js-post-comments-component"> <div id="comments-8185397" class="comments js-comments-container bt bc-black-075 mt12 " data-post-id="8185397" data-min-length="15"> <ul class="comments-list js-comments-list" data-remaining-comments-count="0" data-canpost="false" data-cansee="true" data-comments-unavailable="false" data-addlink-disabled="true"> <li id="comment-10056241" class="comment js-comment " data-comment-id="10056241" data-comment-owner-id="938089" data-comment-score="0"> <div class="js-comment-actions comment-actions"> <div class="comment-score js-comment-edit-hide"> </div> </div> <div class="comment-text js-comment-text-and-form"> <a name="comment10056241_8185397"></a> <div class="comment-body js-comment-edit-hide"> <span class="comment-copy">"...will produce this HTML ..." How? Server-side or client-side?</span> – <a href="../../users/938089/rob-w" title="341,306 reputation" class="comment-user ">Rob W</a> <span class="comment-date" dir="ltr"><a class="comment-link" href="../../questions/8185397/does-textarea-auto-encode-inner-html#comment10056241_8185397"><span title="2011-11-18T16:38:49.550 License: CC BY-SA 3.0" class="relativetime-clean">Nov 18 '11 at 16:38</span></a></span> </div> </div> </li> <li id="comment-10075547" class="comment js-comment " data-comment-id="10075547" data-comment-owner-id="1054151" data-comment-score="0"> <div class="js-comment-actions comment-actions"> <div class="comment-score js-comment-edit-hide"> </div> </div> <div class="comment-text js-comment-text-and-form"> <a name="comment10075547_8185397"></a> <div class="comment-body js-comment-edit-hide"> <span class="comment-copy">The output I meant is raw html, as seen from the browser's "see html source" option, on client side.</span> – <a href="../../users/1054151/benderr" title="17,471 reputation" class="comment-user owner">BeNdErR</a> <span class="comment-date" dir="ltr"><a class="comment-link" href="../../questions/8185397/does-textarea-auto-encode-inner-html#comment10075547_8185397"><span title="2011-11-20T01:53:30.950 License: CC BY-SA 3.0" class="relativetime-clean">Nov 20 '11 at 01:53</span></a></span> </div> </div> </li> </ul> </div> </div> </div> </div> <div id="answers"> <a name="tab-top"></a> <div id="answers-header"> <div class="answers-subheader grid ai-center mb8"> <div class="grid--cell fl1"> <h2 class="mb0" data-answercount="9">2 Answers<span style="display:none;" itemprop="answerCount">2</span></h2> </div> </div> </div> <a name="8185420"></a> <div id="answer-8185420" class="answer accepted-answer" data-answerid="8185420" data-ownerid="72478" data-score="4" itemprop="acceptedAnswer" itemscope="" itemtype="https://schema.org/Answer"> <div class="post-layout"> <div class="votecell post-layout--left"> <div class="js-voting-container grid jc-center fd-column ai-stretch gs4 fc-black-200" data-post-id="8185420"> <button class="js-vote-up-btn grid--cell s-btn s-btnunset c-pointer"><svg aria-hidden="true" class="m0 svg-icon iconArrowUpLg" width="36" height="36" viewBox="0 0 36 36"><path d="M2 26h32L18 10 2 26z"></path></svg></button> <div class="js-vote-count grid--cell fc-black-500 fs-title grid fd-column ai-center" itemprop="upvoteCount" data-value="4">4</div> <div class="js-accepted-answer-indicator grid--cell fc-green-500 py6 mtn8"><div class="ta-center"><svg aria-hidden="true" class="svg-icon iconCheckmarkLg" width="36" height="36" viewBox="0 0 36 36"><path d="m6 14 8 8L30 6v8L14 30l-8-8v-8z"></path></svg></div></div> </div> </div> <div class="postcell post-layout--right"> <div class="s-prose js-post-body" itemprop="text"><p>It doesn't escape the contents. The HTML source remains exactly the same. It just has the capability to display the contents as is which I guess is a requirement of the <code><textarea></code> tag.</p></div> <div class="mb0"> <div class="mt16 grid gs8 gsy fw-wrap jc-end ai-start pt4 mb16"> <div class="grid--cell mr16 fl1 w96"></div> <div class="post-signature grid--cell"> <div class="s-user-card s-user-card"> <time class="s-user-card--time" datetime="answered Nov 18 '11 at 16:14">answered Nov 18 '11 at 16:14</time> <a href="../../users/72478/cherouvim" class="s-avatar s-avatar32 s-user-card--avatar"> <img class="s-avatar--image" src="../../users/profiles/72478.webp" data-jdenticon-width="32" data-jdenticon-height="32" data-jdenticon-value="cherouvim" /> </a> <div class="s-user-card--info"> <a href="../../users/72478/cherouvim" class="s-user-card--link">cherouvim</a> <ul class="s-user-card--awards"> <li class="s-user-card--rep" title="reputation score">31,725</li> <li class="s-award-bling s-award-blinggold" title="15 gold badges">15</li> <li class="s-award-bling s-award-blingsilver" title="104 silver badges">104</li> <li class="s-award-bling s-award-bling__bronze" title="153 bronze badges">153</li> </ul> </div> </div> </div> </div> </div> </div> <div class="post-layout--right js-post-comments-component"> <div id="comments-8185420" class="comments js-comments-container bt bc-black-075 mt12 " data-post-id="8185420" data-min-length="15"> <ul class="comments-list js-comments-list" data-remaining-comments-count="0" data-canpost="false" data-cansee="true" data-comments-unavailable="false" data-addlink-disabled="true"> <li id="comment-10070695" class="comment js-comment " data-comment-id="10070695" data-comment-owner-id="1054151" data-comment-score="0"> <div class="js-comment-actions comment-actions"> <div class="comment-score js-comment-edit-hide"> </div> </div> <div class="comment-text js-comment-text-and-form"> <a name="comment10070695_8185420"></a> <div class="comment-body js-comment-edit-hide"> <span class="comment-copy">Thanks cherouvim for your reply. Do you know if there's a way to output `<` and `>` as they are (not as `<` and `>`)? I'm studying xss attacks and I was looking for a simple way to inject something like <script>alert('yeah')</script>in that textarea. I tried also with %3c and %3e, but it didn't work. Thanks again, best regards</span> – <a href="../../users/1054151/benderr" title="17,471 reputation" class="comment-user owner">BeNdErR</a> <span class="comment-date" dir="ltr"><a class="comment-link" href="../../questions/8185397/does-textarea-auto-encode-inner-html#comment10070695_8185420"><span title="2011-11-19T16:57:02.540 License: CC BY-SA 3.0" class="relativetime-clean">Nov 19 '11 at 16:57</span></a></span> </div> </div> </li> </ul> </div> </div> </div> </div> <a name="13156006"></a> <div id="answer-13156006" class="answer " data-answerid="13156006" data-ownerid="632088" data-score="0" itemprop="suggestedAnswer" itemscope="" itemtype="https://schema.org/Answer"> <div class="post-layout"> <div class="votecell post-layout--left"> <div class="js-voting-container grid jc-center fd-column ai-stretch gs4 fc-black-200" data-post-id="13156006"> <button class="js-vote-up-btn grid--cell s-btn s-btnunset c-pointer"><svg aria-hidden="true" class="m0 svg-icon iconArrowUpLg" width="36" height="36" viewBox="0 0 36 36"><path d="M2 26h32L18 10 2 26z"></path></svg></button> <div class="js-vote-count grid--cell fc-black-500 fs-title grid fd-column ai-center" itemprop="upvoteCount" data-value="0">0</div> </div> </div> <div class="postcell post-layout--right"> <div class="s-prose js-post-body" itemprop="text"><p>The dom element should have properties like this:</p> <pre><code>innerHTML = '<script>' innerText = '<script>' </code></pre></div> <div class="mb0"> <div class="mt16 grid gs8 gsy fw-wrap jc-end ai-start pt4 mb16"> <div class="grid--cell mr16 fl1 w96"></div> <div class="post-signature grid--cell"> <div class="user-info "> <div class="user-action-time">edited <span title="2012-10-31T22:19:25.687" class="relativetime">Oct 31 '12 at 22:19</span></div> <div class="user-gravatar32"></div> <div class="user-details" itemprop="author" itemscope="" itemtype="http://schema.org/Person"> <span class="d-none" itemprop="name">Rusty Rob</span> <div class="-flair"></div> </div> </div> </div> <div class="post-signature grid--cell"> <div class="s-user-card s-user-card"> <time class="s-user-card--time" datetime="answered Oct 31 '12 at 10:37">answered Oct 31 '12 at 10:37</time> <a href="../../users/632088/rusty-rob" class="s-avatar s-avatar32 s-user-card--avatar"> <img class="s-avatar--image" src="../../users/profiles/632088.webp" data-jdenticon-width="32" data-jdenticon-height="32" data-jdenticon-value="Rusty Rob" /> </a> <div class="s-user-card--info"> <a href="../../users/632088/rusty-rob" class="s-user-card--link">Rusty Rob</a> <ul class="s-user-card--awards"> <li class="s-user-card--rep" title="reputation score">16,489</li> <li class="s-award-bling s-award-blinggold" title="8 gold badges">8</li> <li class="s-award-bling s-award-blingsilver" title="100 silver badges">100</li> <li class="s-award-bling s-award-bling__bronze" title="116 bronze badges">116</li> </ul> </div> </div> </div> </div> </div> </div> <div class="post-layout--right js-post-comments-component"> </div> </div> </div> </div> </div> <div id="sidebar" class="show-votes" role="complementary" aria-label="sidebar"> <div class="module sidebar-linked"> <h4 id="h-linked">Linked</h4> <div class="linked"> <div class="spacer"> <a title="Vote score (upvotes - downvotes)"><div class="answer-votes answered-accepted default">4</div></a> <a href="../../questions/42252665/textarea-content-when-outputted-via-innerhtml-shows-as-encoded" class="question-hyperlink">Textarea content when outputted via innerHTML shows as encoded</a> </div> </div> <div class="linked"> <div class="spacer"> <a title="Vote score (upvotes - downvotes)"><div class="answer-votes answered-accepted default">4</div></a> <a href="../../questions/6130097/how-come-when-i-display-javascript-in-a-textarea-it-executes" class="question-hyperlink">How come when I display JavaScript in a TextArea, it executes?</a> </div> </div> </div> </div> </div> </div> <script src="../../static/js/stack-icons.js"></script> <script src="../../static/js/fromnow.js"></script> </body> </html>