HTML/Javascript etc being ran via text fields

Hello everyone,
I was just wondering what the implications of a user inputting javascript and other tags are on fields. Is this something to be worried about?
I realise that it's perfectly possible to insert hyperlinks and what not into a database table this way, so that when they are reported back through Apex, they will appear as the link. But could it be possible to run javascript and other code just from a text field on a screen which also contains a submit button?
I just want to know how far I need to be careful with such things.
Thanks in advance for your help!
Robin
Edit: Also, what implications do pages with submit functions have on validations created in Apex? If javascript was input into a text field to run on submit, would the validation pick it up, as they seem to run after the page has been submitted?
Message was edited by:
User_resU

Thanks for your help, guys!
Basically, I've already got a function set up using regular expressions to filter out anything bar spaces inside any <> brackets, so it will return an error.
I wish I could use a generic escape special characters builtin, but users will sometimes wish to use these characters, so I have to get a bit more detailed.
What I'm worried about are apex validations...they appear to work after a submit...surely if a page is submitted, then any XSS will run and the effects be carried out?
Are apex validations for pages and items to be relied upon in these cases? For the most part, when it comes to inserting into a table, I have a js script on a button that fires before the page is submitted in order to prevent anything in <> being inserted into a table. Validations don't have this effect though, and only seem to run on a submit. Isn't running on a submit too late?
Thanks for your help.
Robin
Edit: Just to let you know that I've done my own testing on it, and think that validations do prevent the code running on submit, but just want to be sure, as I know they'll be people who know more than me on the subject.
I input this
<script>onsubmit="alert('Hello world');"</script>
into a text field and clicked submit with and without a validation attached to the text item, but both didn't interpret the javascript; is this because there's some kind of builtin in Apex that prevents this happening, or is it that other examples of code would be interpreted?

Similar Messages

PDFMaker: Extra chars being rendered in text fields

I've used PDFMaker (Adobe Acrobat 9 Professional) to render a PDF from a Microsoft Word document. However, the PDF contains extra characters; specifically, characters are added to any fields referencing headings in the document.
In the following screen capture, you can see an example:
http://img510.imageshack.us/my.php?image=extracharactersinfieldstl8.jpg
The page header should read "Introduction * Introduction". These aren't static text, but text fields that reference headings. However, Acrobat has introduced the extra characters "1B" and "19B".
I've checked, and the headings that the field references are actually rendered correctly (one heading - Introduction - is shown on the screen capture itself).
Regards,
Paul.

Read this:
CallieAnn48103, "Acrobat 8 adds extra characters to the running header" #1, 5 Dec 2006 5:49 am

Images not being sent via text

My wife and I both have iPhone 4s. I don't recall ever trying this with previous models but recently with these 4s whenever we take a photo and try sending it to each other via SMS text, nothing happens. That is, no picture is received by the other person tho the sending phone implies that the image had been sent. When we take the photo it gives us the option to send it thusly so obviously the phone has that capability. Is there a step we're missing?

Thanks for posting this. So for awhile my mom and wife were receiving pictures from me via text from my Iphone. Then one day it just stopped. It is showing up on their end as an empty text. Please help. Don't know how to fix. I have tried many things now. This just suddenly happened.
Thanks.

Filling in Rich Text fields in PDF

Is it possible to fill in RichText fields in a PDF from Coldfusion? I need to have certain words bolded, etc. I created the form in liveCycle and the field in question has Rich Text selected Field and Data format. When I assign data to the field through ColdFusion, the text is always just plain text. Any ideas?
Matt

Hi,
Thank you Linda Li. I saw the URL link you sent me on your reply
http://office.microsoft.com/en-in/infopath-help/insert-a-rich-text-box-HP010080917.aspx
Our SharePoint 2010 InfoPath 2010 form is working.
Where i need help is the emails sent from SharePoint Designer WorkFlow Email function - The SharePoint site owners do not want to send by email PLAIN TEXT data from the InfoPath RTF they want to send by email Rich Text value look ups from the RTF.
SEND E-MAIL IN A WORKFLOW
http://office.microsoft.com/en-us/sharepoint-designer-help/send-e-mail-in-a-workflow-HA010239042.aspx
everything works fine - except aligning the RTF with the other field look ups. our email has an HTML table where we have plain text fields, date fields, and RTF - I need with INLINE CSS STYLE code since remote CSS or any type of CSS does not work only INLINE
CSS worsk on SP WorkFlow Emails
EXAMPLE: you can create a Workflow Variable that has a simple HTML table, and when SP workflow sends the email the values in the cells do not line up, if the RFT values are blank from the InfoPath form the email table looks greate, as soon as you type any
value in the InfoPath form RFT the email does not line up to the any of the other html cell text or other Look up values to the InfoPath form.
<table>
<tr><td>Title:</td><td>[%Current Item:Title%]</td><td>[%Current Item:Notes1%]</td></tr>
<tr><td>Created by:</td><td>[%Current Item:CreatedBy%]</td><td>[%Current Item:Notes2%]</td></tr>
<tr><td>Date Created:</td><td>[%Current Item:Created%]</td><td>[%Current Item:Notes3%]</td></tr>
<tr><td>Modified by:</td><td>[%Current Item:ModifiedBy%]</td><td>[%Current Item:Notes4%]</td></tr>
<tr><td>Date Modified:</td><td>[%Current Item:Modified%]</td><td>[%Current Item:Notes5%]</td></tr>
</table>
-Isaack

Auto scrolling dynamic text field(news ticker)

> This message is in MIME format. Since your mail reader
does not understand
this format, some or all of this message may not be legible.
--B_3272625483_2679871
Content-type: text/plain;
charset="US-ASCII"
Content-transfer-encoding: 7bit
Does anyone know how to make a scrollable dynamic text field
scroll on its
own and also with user interaction?
Thanks in advance for your help.
Bill
--B_3272625483_2679871
Content-type: text/html;
charset="US-ASCII"
Content-transfer-encoding: quoted-printable
<HTML>
<HEAD>
<TITLE>Auto scrolling dynamic text field(news
ticker)</TITLE>
</HEAD>
<BODY>
<FONT FACE=3D"Verdana, Helvetica, Arial"><SPAN
STYLE=3D'font-size:12.0px'>Does =
anyone know how to make a scrollable dynamic text field
scroll on its own an=
d also with user interaction?<BR>
<BR>
Thanks in advance for your help.<BR>
<BR>
Bill</SPAN></FONT>
</BODY>
</HTML>
--B_3272625483_2679871--

I found this:
http://www.kirupa.com/developer/mx/dynamic_scroller.htm
I copied the actual scroller and put it in my .fla and it
worked! Now if I can only figure out links in XML...

PHP/MySQL: 'Add New' text field from menu in form

I am creating an events posting website. I'm having a hard time finding the right words to describe this, but: I'd like the user to select a venue from the drop menu, but then if it isn't there, to select 'add new' from the dynamic menu, and have a new text field activate where they can enter in the new venue name. My database is currently set up so the event table links to the venue table through a venueID. Is there a way to insert the name from the new text field into the venue table, and have the rest of the form still submit to the event table? Sorry this is so wordy, but I'd appreciate any help. Thank you.

You cannot add a new value to a related table at the same time as inserting a record. So, to do this, you would need to use both JavaScript to add the new text field, and PHP conditional logic to handle the update to both tables. It's certainly doable, but not with the Dreamweaver server behaviors. You would need to do a lot of hand-coding yourself.
The way that I approached a similar problem in my "Essential Guide to Dreamweaver CS4" was to permit NULL values in the column that holds the foreign key, and insert nothing into that field if the value hadn't already been registered in the related table. I created a static value in the dynamic menu for "Not registered".
After inserting the new record with "not registered", the user then needs to enter the new value in the related table.
Once that has been done, display a page that lists all records. In the SQL, I use a LEFT JOIN to ensure that "not registered" items come up as well. You can then edit the item to add the value from the dynamic menu.
It's not the most elegant way to do it, but it works if you don't have the skill or time to hand-code all the logic yourself.

Bug? Text field & Button are still visible when solid-filled rectangle is placed on top of them

Adobe Live Cycle 7.1
It cannot work when i tried to make the text field and button invisible without JavaScript:
1. Create a text field with any default value and button.
2. Create a filled color rectangle.
3. Set the rectangle on top of all objects (right click it and select "bring to front")
4. View in Pdf.
5. Result:
Text field's caption and border are invisible (covered by rectangle) ,but the text field's raw value and the button are visible.
Is this a bug?

It's difficult to tell. I can see what you're trying to accomplish but it's possible that Acrobat is giving priority to fillable fields over static objects (such as the rectangle) regardless of z-order (i.e. "bring to front", "send to back"...).
You can make objects invisible without having to write any script by selecting the objects which should be invisible and setting the Presence property, on the Object palette's Field tab, to
Invisible or
Hidden - Exclude from Layout. The former means the objects won't be visible but they will still be a factor in the way in which objects are placed on the form while the latter means they're totally hidden from the form.

How to make an unmodifiable text field

Can someone let me know what the html code is for an unmodifiable text field?

Do you mean a textbox in a form?
I am not clear on what you want to do and why? Why make a text field if you don't want to modify it? If you don't want it modified, simply display as text?
Perhaps I don't fully understand. Can you give more details?
Brad Lawryk
Adobe Community Professional: Dreamweaver
Northern British Columbia Adobe Usergroup: Manager
Thompson Rivers University: Dreamweaver Instructor
My Adobe Blog: http://blog.lawryk.com

How to multiply a numeric field (with Quantity) with a Cell (text field with price) to get a total?

In Javascript I suggest multiplying the text field by 1 to change it to a numeric type then multiply this with the other numeric field. The code would look something like:
Total.rawValue = numericField.rawValue * (textField.rawValue*1)

Using Javascript to create concatenated string from checkbox fields to one text field

Hi. I have a PDF form that I am trying to have output to a spreadsheet that matches my database schema. Here is the dilemna:
* I have a set of checkboxes for available languages (LANGUAGE_ENGLISH, LANGUAGE_SPANISH, etc.) When they export to spreadsheet, the value is TRUE.
* I need to take values from checked boxes and create a single string in a text field called LANGUAGE_DISPLAY (so my UI will not need to do the concatenation). If LANGUAGE_ENGLISH is TRUE (checked), append "English, " to LANGUAGE_DISPLAY, else append "". Then, if LANGUAGE_SPANISH is TRUE (checked), append "Spanish, " to LANGUAGE_DISPLAY, else append "". And on and on
In the LANGUAGE_DISPLAY text field properties, I am inserting a Custom Calculation script to try to achieve this, but am not getting any results. I tried teh following even trying to pull the checkboxes default values and string them together:
box1 = this.getField("LANGUAGE_ENGLISH").value.toSrting();
box2 = this.getField("LANGUAGE_FARSI").value.toSrting();
box3 = this.getField("LANGUAGE_MANDARIN").value.toSrting();
event.value = box1 + ', ' + box2 + ', ' + box3;
I also played with this to get the desired strings output...but to no avail:
if ( LANGUAGE_ENGLISH.rawValue == true )
box1.rawValue = "English, ";
if ( LANGUAGE_FARSI.rawValue == true )
box1.rawValue = "Farsi, ";
if ( LANGUAGE_HEBREW.rawValue == true )
box1.rawValue = "Hebrew, ";
event.value = box1 + box2 + box3;
Then I tried to simplify to see one field output so used this script...still no results:
event.value = "";
var f = this.getField("LANGUAGE_ENGLISH");
if ( f.isBoxChecked() == true) {
event.value = "English";
Couple questions:
1) Am I on the right track with any of these scripts?
2) Is there something else I need to do to get the script to run before running the Create Spreadsheet with Data Files comman in Acrobat to get my csv file output? Maybe there needs to be some event to get the checkbox values read by that field in order to calculate/create the string.
Appreciate any help you can provide.

LiveCycle Designer has shipped with all Acrobat Professional versions since the "Professional" version was introduced with version 6.
You do not let us know want results you get in the field or the JavaScript console.
Using:
box1 = this.getField("LANGUAGE_ENGLISH").value.toString();
box2 = this.getField("LANGUAGE_FARSI").value.toString();
box3 = this.getField("LANGUAGE_MANDARIN").value.toString();
event.value = box1 + ', ' + box2 + ', ' + box3;
returns "Off, Off, Off", when no box is checked and returns "Yes" for the appropriate box being checked when the default value is used for the creation of the check box. So if one would make the 'Export Value' of the box from the default value of 'Yes" to the appropriate language, one would get a more desirable result. But for each unchecked box the value would appear as "Off". So one needs to change the 'Off' value to a null string. But one is still left with the separator when there is an unchecked option.
Using the following document level function:
// Concatenate 3 strings with separators where needed
function fillin(s1, s2, s3, sep) {
Purpose: concatenate up to 3 strings with an optional separator
inputs:
s1: required input string text or empty string
s2: required input string text or empty string
s3: required input string text or empty string
sep: optional separator sting
returns:
sResult concatenated string
// variable to determine how to concatenate the strings
var test = 0; // all strings null
var sResult; // re slut string to return
// force any number string to a character string for input variables
s1 = s1.toString();
s2 = s2.toString();
s3 = s3.toString();
if(sep.toString() == undefined) sep = ''; // if sep is undefined force to null
assign a binary value for each string present
so the computed value of the strings will indicate which strings are present
when converted to a binary value
if (s1 != "") test += 1; // string 1 present add binary value: 001
if (s2 != "") test += 2; // string 2 present add binary value: 010
if (s3 != "") test += 4; // string 3 present add binary value: 100
/* return appropriate string combination based on
calculated test value as a binary value
switch (test.toString(2)) {
case "0": // no non-empty strings passed - binary 0
sResult = "";
break;
case "1": // only string 1 present - binary 1
sResult = s1;
break;
case "10": // only string 2 present - binary 10
sResult = s2;
break;
case "11": // string 1 and 2 present - binary 10 + 1
sResult = s1 + sep + s2;
break;
case "100": // only string 3 present - binary 100
sResult = s3;
break;
case "101": // string 1 and 3 - binary 100 + 001
sResult = s1 + sep + s3;
break;
case "110": // string 2 and 3 - binary 100 + 010
sResult = s2 + sep + s3;
break;
case "111": // all 3 strings - binary 100 + 010 + 001
sResult = s1 + sep + s2 + sep + s3;
break;
default: // any missed combinations
sResult = "";
break;
return sResult;
And the following cleaned up custom calculation script:
box1 = this.getField("LANGUAGE_ENGLISH").value;
box2 = this.getField("LANGUAGE_FARSI").value;
box3 = this.getField("LANGUAGE_MANDARIN").value;
if (box1 == 'Off') box1 = '';
if (box2 == 'Off') box2 = '';
if (box3 == 'Off') box3 = '';
event.value = fillin(box1, box2, box3, ', ');
One will get the list of languages with the optional separator for 2 or more language selections.

Insert JQuery .html into text field nested inside of symbol

This is one of those, 'it should be so simple....so of course, it's not' question.
Got a nested symbol. Rather simple one. Inside the symbol is a background rectangle and a text field. When I click a button, it should insert the HTML I give it from the click event.
Now initially I did this by just using the text field by itself. No nesting. This is the code:
sym.$("copy").html("Edge Rocks!");
OK, success! The text loaded just fine.
Now let's insert that text field inside of a symbol. And let's call that symbol 'content'.
Now I try....
sym.$("content").$("copy").html("Some new text");
Result? Nothing.
Tried using stage instead of sym and even added a var stage = sym.getComposition().getStage() statement before that. Nope.
Yea, they don't make it easy. So what's the solution?
Here's my example file.
https://www.dropbox.com/s/5n1ehhsp7r3rbt6/text.zip?m
BTW, ran this in Firebug's console. No errors.

Yes and no, Elaine. Kind of confusing but if the button is directly on the stage, that code works. However, if that button gets nested inside of its own symbol, the code no longer works and a JS error appears in console.
So in other words, the button and the text field are nested inside of symbols, but not the same symbol. So it's a question of the path being used.
I tried switching sym to Stage to no effect.
Redid the test file and uploaded it to Dropbox:
https://www.dropbox.com/s/ha24ki0wp0fb2nw/text2.zip?m

Exchange 2010 Conference Room Resource mailbox. Additional text field HTML images

In the same vein as this question:
http://social.technet.microsoft.com/Forums/systemcenter/en-US/338b4fff-e8df-41aa-8066-a32a9f76fa92/exchange-2010-conference-room-resource-mailbox-additional-text-field
Have successfully created Additional text messages that actually work with a surprising amount of HTML in it (Tables, link colours, hyperlinks etc...)
The one thing we can't seem to crack is the ability to show images, is this possible?
(have tried the usual suspects of:
img src="x.jpg"
also tried making sure the img tag was self closing, no luck
td background="x.jpg"
td background (css property)
but no joy and ran out of ideas, any help out there?
Many thanks in advance!

Have you tried the same formatting that is required to add an image in a disclaimer:
http://technet.microsoft.com/en-us/library/bb124352.aspx#Images

Cant figure out how to add text fields etc. in dreamweaver, layout made in photoshop

hi all
ok... first of all i want to say im sorry for posting such a noob question, but im new to this, so please take a few minutes to help me out
so i have kind of an annoying problem.
ive made an webpage layoout in photoshop. ive made "boxes" i want to put my content in. i have sliced it and got it in to dreamweaver.
im gonna use the page for bloging and stuff so i would like go have an text field where i can edit text and then post it to the site. but the problem is that everytime i try to insert ext fileds etc, it dosent place correctly and its white and not big enough at all.... ill show you a screenshot to explain..
so yeah... u see the 3 "boxes", in the big one i want to be able to add text and since its not so big, i want to have a scroll bar in it. the two small ones are boxes i wud like to use for index or something (havent really figured out what i wanna have on the site yet)
ok... now i will show u what happens when i try to add the text area to the page.
yeah... so u are all able to see that this is not what i wanted to happen......
i want the textfield to be where the grey"box"is ... but it wont let me... also it gets all white... it wuld be nice to get it to have the color the grey box have
so help would be great
and btw, i dont have knowlege in html and css coding, so if u could explain it so i dont have to do coding in text, but only visual, it would be nice. yea im a naab...
thanks in advance

Use graphics apps for images only. DO NOT export HTML from Photoshop or Fireworks. The result is table based code that precisely fits the image slices and nothing else.
When you try to edit graphics app generated code in DW, your page layout will fall apart.
The following procedure is the workflow you should follow:
Part 1 - Initial Design
http://www.adobe.com/devnet/dreamweaver/articles/dw_fw_css_pt1.html
Part 2 - Markup preparation
http://www.adobe.com/devnet/dreamweaver/articles/dw_fw_css_pt2.html
Part 3 - Layout and CSS
http://www.adobe.com/devnet/dreamweaver/articles/dw_fw_css_pt3.html
If you get stuck, post back with specific questions and a link to your test page.
Nancy O.
Alt-Web Design & Publishing
Web | Graphics | Print | Media Specialists
http://alt-web.com/
http://twitter.com/altweb

How do I clear a form text field during validation using JavaScript?

I am just learning JavaScript and the Acrobat API. I have a form created in adobe acrobat 9 standard (starting from an existing form in MS Excel). There is a text field for a Social Security Number. I have a custom format script and keystroke script and a custom validation script. I would like to add to the existing validation script, that if what is entered doesn't match the validation test, then clear out the field as in erase all the characters that were typed into the field. I want this to happen no matter what. So even if someone filled in a valid SSN number and then moved to the next field, but then went back to the SSN field and decided to change their entry and this new entry was "invalid" then clear out the field (do not revert to what was typed in the field originally, even though it was considered valid by the script). (There is currently no default value for this field.) Thank you inadvance for you help on this.
Here is the current validation script:
// only run when field not blank
if (event.value != "")
// RegExp for validation #########
var re = /^(\d{3})(\d{2})(\d{4})$/
if(re.test(event.value) == false)
app.alert("Enter a 9-digit Social Security number with no spaces or special characters (e.g., 555555555). It will be converted to the format 555-55-5555.")
     //Here is where I've tried adding all of these lines, but none of them will clear out what is in the field
          //this.resetForm([event.target.name]);
          //event.target.value == "";
          //getField("SSN 1").value = getField("SSN 1").defaultValue;
          //getField("SSN 1").value == "";
          //event.rc = false;
And incase these are somehow affecting it, here are the other scripts being processed on this field:
Keystroke script:
var input=event.value;
var chars=input.length;
if( event.willCommit || chars==8 )this.getField("Name 1").setFocus();
Format script:
var re = /^(\d{3})(\d{2})(\d{4})$/
if(re.test(event.value) == true)
// add "-"
event.value = RegExp.$1 + "-" + RegExp.$2 + "-" + RegExp.$3;

Thank you very much. I did try that before, but I was using event.value == ""; I guess in this case I'm assigning the value of "", not making the value equal "".

It possible using javascript to change the value of another jsf text field?

In my case, I have an input text field and would like to copy it's value on the onchange() event into another text field. Using the destination text field's Id and assigning some content with it's .value property

Woodstock apparently renders some Javascript/DOM with some homegrown widget framework which on its turn renders the HTML DOM tree instead of plain vanilla HTML. Correct me if I'm wrong, to confirm this, just view the generated HTML source of the page.
After some Googling I found out that you need getProps() and setProps() to get and set element attributes respectively.
[http://google.com/search?q=webuijsf+domnode+site:sun.com].
If you stucks with this, I recommend you to post this question at a forum or mailinglist devoted to Woodstock, e.g at their own homepage at dev.java.net or the Netbeans forum at nabble.com. You're here at a Sun JSF forum, not at a Woodstock forum.

HTML/Javascript etc being ran via text fields

Similar Messages

Maybe you are looking for