Stripping out html from form submissions

My web developer is using the attached code to strip/disallow
html code from form submissions in an effort to prevent someone
from posting dangerous scripts or code via a form or blog.
Problem is, I DO want to at least allow people to post url
links to external content like youtube videos, their own webstes,
images etc.... Basically if it is something hosted AND viewed on a
site other than mine I would like to give them the ability to link
to it. How could I edit the code to allow links of this nature or
is there a better way to do this?
My developer has basically told me there is no other way. It
is either disallow it all or open it up. I disagree with this and
am looking for a 2nd opinion.

url links are not html.
Regular expressions are not my strength, but it looks like
that function is simply replacing sets of angle brackets with empty
strings.
In other words, if your users submit
http://somesite.com, that will not
be affected by the function. However, if they submit <a href="
http://somesite.com">, it will be
transformed to href="
http://somesite.com". In either
case, it will be text, not a link.

Similar Messages

Stripping out dashes from variable

I have a jsp page that dynamically build a list of select boxes based on information out of a record set. As I build the select box I am including an onChange function that submits the form once the user selects something from the drop down list. Basically it looks like this: out.println("<select class='select' name='"+selectName+"' onChange='document."+formName+".submit();'>");
Az you can see the select name and formname are also dynamically added based on the record set return. My problem is in the database there are dashes in some of the data so I am getting something that looks like this in my resulting html: select class='select' name='A-10' onChange='document.A-10.submit();'>");
This dash is causing the onChange to not work so I need a way to strip out the dash so that the results would be A10 as apposed to A-10
Any thoughts??
p.s. This is how I filling the variable:
String selectName = request.getParameter("name");
String formName = request.getParameter("DataSet");

first of all, I dont understand why you use multiple forms on one page, but thats just me. Second, you can use
documents.forms[0].submit() to avoid the names. So just loop through your forms and use
out.println("document.forms[" + i + "].submit()");

Stripping out data from unstructured documents

I have hundreds of word and html documents that I need to strip out certain information. The html docs are completely unstructured. The word documents may or may not have the same structure. How can I leverage PL/SQL to extract out the data that I need? I have seen scripts where using PL/SQL you can give a byte position number. This may work for extracting out some of the data if positioned in the same place but I am looking to simplify the process and get the right information out in one pass. Any help would be greatly appreciated. I am not necessarily looking for an exact answer but rather information that can lead me in the right direction. Of course the exact answer wouldn't hurt.

I read all of the thread for that particular post and I still don't believe I have what I need.
Maybe it is the instr function that you wanted me to look at and maybe not. I just don't know how I would use that to extract data.
What I am looking to do is to use some kind of PL/SQL statement to extract a unique identifier that will be in the document, dates that the document was created or appended, and then some region numbers. So can I use instr to find a value from each document, hold it in a flat file and then import this information back into the database? The value of course will be different in every document.
These files are currently not in a database. I am trying to get this information out of the document to store as metadata for each document. Am I looking at the right way to do this using PL/SQL or is there some other method of data extraction that I should consider

Html from forms

hi every one,
i have an html file and i want to show it on IE (or any navigator) from forms 6i, but i didn't find the way, because web.show_document bult_in work with forms server i think, so with a simple html file i don't know..
please help me.
ramzi

Hi François, i find that this statement is very fast than the first one, i used your command line and i modify it,
host('cmd /c start file:///c:/page.html',no_screen);
thank you very much

Calling HTML from Form

Hi,
I want to call a HTML file from a FORM. How to do so? Pls help me...
Thanx in advance.
Rehards,
Swarup

in c/s:
host('cmd /c "start http://www.oracle.de"', no_screen);
in web:
web.show_document('http://www.oracle.de');
Thanx Christian, for ur reply.
But I am facing another problem. Every time I call a HTML file with web.show_document(), it searches in the http://<address of the web server>:8888/forms90 directory. Even if I copied the HTML file in the directory it is not opening the file. I have tried by putting the HTML file in the default-web-app directory of the web server, it is not working.
I am using Oracle 9iAS as a Web Server.
Pls help me..
Thanx in advance.
Regards,
Swarup

How to strip HTML out of the form field but leave the basic user formatting?

What would you recommend to automatically strip out HTML that a user has entered into a form field? At the same time we need to preserve the basic formatting that was submitted by the users i.e. replace <p> tags with CRLF, etc. StripHTML function is perfect but it removes all HTML and therefore, all formatting. Is there anything more flexible?
Thanks!

Do you need to strip it, or just render it inoperable.
The latter can be done with the htmlEditFormat() and htmlCodeFormat() functions.
If you want the striping, take a look at related functions at the http://www.cflib.org site. I know I have seen HTML replace functions that had the ability to be configured to strip and|or not strip a select list of tags.
StripHTML() may actually have this feature (I believe it is hosted at cflib.org). You may just need to see the documentation on how to configure it thus.

How do you strip out certain groups of characters from a String variable

for exapmle...
String date = "11-Feb-2005";
String day;
String month;
String year;
how would you strip out '11' from date to assign it to 'day', and 'Feb' to assign it to 'month' and '2005' to assign it to 'year'.
in my program the variable 'date' will always be in the format of:
ist two digits are numbers followed by '-'
then three digits (letters) followed by '-'
then four digits that are numbers.
i think it has something got to do with charAt or something, im not sure how to do it.
any ideas?

yea i tried the first method and it works fine.
thanks very much.
also... i tried the other one and it outputs... 11 1 2005
which means it works but you see i wanted to put the date in the format of...
Calendar date = new GregorianCalendar(2005, Calendar.FEBRUARY, 11); so i can compare it to another Calender object to see which one is earlier.
that is why i am doing it like this...
Calendar date = new GregorianCalendar(+ year + ", Calendar." + month + ", " + day);
for example...
Calendar xmas = new GregorianCalendar(1998, Calendar.DECEMBER, 25);
Calendar newyears = new GregorianCalendar(1999, Calendar.JANUARY, 1);
// Determine which is earlier
boolean b = xmas.after(newyears); // false
b = xmas.before(newyears); // true
anyways i am just curious.

Remove HTML from Interactive report download

I have interactive reports where the column link on a specific column has to be dynamic, that means, it cannot be hard coded in the column link attributes. The following is an example of one such report query:
case when d.object_type_description ='Business Service' then
'< href="f?p='||:app_id||':183:'||:app_session||'::::P183_OBJECT_ID:'||d.id||'">'||d.object_name||'</>'
when d.object_type_description = 'Real Time Event' then
'< href="f?p='||:app_id||':162:'||:app_session||'::::P162_OBJECT_ID:'||d.id||'">'||d.object_name||'</>'
else
   null
end as "OBJECT NAME"As you see in the above example, the link on the "Object Name" column could either redirect to page 183 or to page 162 based on the "Object Type Description" column.
The column attribute of the "Object Name" column has "Display Type" set to "Standard Report Column". That works perfectly fine in the UI of the report. However, if I download the IR data (in any format) from the Actions -> Download menu, the object name column values are downloaded with the HTML characters as:
< href="f?p=15548:183:6072319179284::::P183_OBJECT_ID:255245470513999672860510787772603748464">JP010000</>where JP010000 is the object name.
Is there a way I can strip the HTML from the column values in the downloaded files?
I am using Apex 4.1.

Rohit,
You can define the link in the query, make it hidden, use the value as column link URL. So, your query will look like the following:
d.object_name,
case when d.object_type_description ='Business Service' then
    'f?p='||:app_id||':183:'||:app_session||'::::P183_OBJECT_ID:'||d.id
when d.object_type_description = 'Real Time Event' then
    'f?p='||:app_id||':162:'||:app_session||'::::P162_OBJECT_ID:'||d.id
else
   null
end linkChange the display type of LINK column to Hidden. In column link, enter #OBJECT_NAME# as Link Text. Select URL as Target. Enter #LINK# as URL value. In APEX 4.2, you can do this in easier way by defining HTML Column Expression.
Regards,
Christina
Edited by: cbcho on Sep 27, 2012 11:35 AM

Parse HTML from Multiple Lines of Text

Does anyone know if there's a way to extract the text from a Multi-line text enterprise custom field? I'm using the OData feed to read this field into an Excel report, and the text is being returned (from Project Online) with HTML. I'm trying to either retain
the formatting in Excel or strip the HTML from the field value.
Anyone have any suggestions?
Thanks,
Roland

Hi Roland,
See this
similar thread, advicing to create a macro.
Hope this helps,
Guillaume Rouyre, MBA, MVP, P-Seller |

How does one strip out all Live Cycle data from a PDF and rebuild the form fields in Acrobat?

Someone in a different department built a bunch of forms in Live Cycle. We now need to make minor edits to these forms but we all have Macs and can't use Live Cycle. Currently our only option to change a date and a name on each form is to buy a new Windows workstation, buy a copy of Live Cycle and train someone for it.
I understand the Live Cycle technology and Acrobat technology for forms are somehow different but there must be a way to just strip out all the Live Cycle form programming so that I just have the bare PDF with the text and layout. Then make the text edits and rebuild the form fields in Acrobat.

It depends on your PDF. Is the PDF a static XFA or a dynamic XFA?
You can check to see if the PDF is static/dynamic by clicking File=>Save As, and it should say static or dynamic PDF as file type.
iText will work with Static XFA forms created in LiveCycle. Dynamic XFA forms are not supported.
You can also submit XML data to a server side script and parse the XML data using C# system.xml.xmlreader.
Another tool that may speed the development of the project is:
http://www.fdftoolkit.net/
Note: FDFToolkit.net utilizes iText Technologies.

WebHelp stripping out form action

I have a form in my documentation where users may fill out questions, click a "Submit" button, and it is emailed to me. I remember testing this a few years ago and it worked great. Recently, someone contacted us to say he never heard back from his form. I then tested it, and it never was emailed to me. When I checked the HTML code, it's being stripped for some reason. I'm on the HTML tab, I type in the <form action="mailto..." > data. Then I click to the designer tab. When I click back to the HTML tab, it's gone! No sign of what I JUST typed! Here's the "naked" code:
</head>
<body>
<robohelp><form>
</robohelp>
<robohelp><div align=left></robohelp>
Where you see the <form>, I had just typed in the actual action part. It just disappears though. Further, the bottom part of the code, where the closing </form> tag is, that </form> disappears as well. I type it in, click off the tab, and get this:
<p><input type=submit name=submit value="Send to Us"><input type=reset name=reset value="Start Over"></p>
</body>
</html>
No </form> tag. Gone. I haven't even clicked Save or ANYTHING at this point. Any ideas why Robohelp would be stripping code like this? Much appreciated.

Hi there
By broken, I meant my crystal ball is broken (and sadly still is )
When you visited the forums to post, I'm guessing you missed seeing this link? If so, please click it and give it a once over. See if that illuminates my reaction.
Click image below for possibly larger view
Cheers... Rick
Helpful and Handy Links
RoboHelp Wish Form/Bug Reporting Form
Begin learning RoboHelp HTML 7 or 8 within the day - $24.95!
Adobe Certified RoboHelp HTML Training
SorcerStone Blog
RoboHelp eBooks

Outlook pops out on form submit

I am making a form on Dreamweaver CC and I want to integrate that form in a Muse website and when I click submit, a window from Outlook pops out to send an e-mail to the recieptient e-mail.
I already read here but I don't know if I can integrate a PHP script with Adobe Muse files on my server. Would they enter in conflict or that's fine?
This is the code of the form:
<form action="mailto:[email protected]" method="get" enctype="text/plain" name="form1">
<p>
<label for="textfield"><strong>Name:</strong></label>
<input type="text" name="textfield" id="textfield">
<label for="email"><strong>Email:</strong></label>
<input type="email" name="email" id="email">
</p>
<p>
<label for="textfield2"><strong><br>
    PICK-UP<br>
    <br>
    Location:</strong></label>
<input type="text" name="textfield2" id="textfield2">
<label for="date"><strong>Date:</strong></label>
<input type="date" name="date" id="date">
<label for="time"><strong>Time:</strong></label>
<input type="time" name="time" id="time">
</p>
<p>
<label for="textfield3"><strong><br>
    DROP-OFF<br>
    <br>
    Location:</strong></label>
<input type="text" name="textfield3" id="textfield3">
<label for="date2"><strong>Date:</strong></label>
<input type="date" name="date2" id="date2">
<label for="time2"><strong>Time:</strong></label>
<input type="time" name="time2" id="time2">
</p>
<p>
<label for="textfield4"><strong><br>
    Type of Car:</strong></label>
<input type="text" name="textfield4" id="textfield4">
</p>
<p>
<label for="textarea"><strong><br>
    Notes/Extras:</strong> <em>(i.e.: GPS, Baby Seat, etc...)</em><br>
</label>
<textarea name="textarea" id="textarea" cols="45" rows="5"></textarea>
</p>
<p> </p>
<p>
<input name="submit" type="submit" id="submit" formaction="Submit Form" formmethod="GET" value="Send">
</p>
</form>
Waiting an answer.
Best wishes,
Miguel

Mailto: links on form submit are not reliable for several reasons.
Most web mail users do not have Outlook or similar e-mail clients installed on their system. When they click your submit button, nothing will happen.
Mailto: links do not hide your e-mail address from harvesters and spam bots.
Your form is not secure from spam bots and hackers.
AFAIK, Muse does not support server-side scripting. But that shouldn't preclude you from using a contact form with a separate form-to-email processing script. You point your HTML form to the script using the action attribute.
<form action="your_script.php"
Which script depends on your server. Ask your hosting provider if they have scripts you can use. If they don't, find out which server-side languages your hosting plan supports -- php, asp.net, coldfusion, perl, etc...
This will narrow your search form appropriate scripts you can use.
Nancy O.

I opened Adobe Acrobate XI Standard to create a form. I then selected From Template, which took me to Adobe FormsCentral Online. However, I think the form is an HTML web form. All I wanted was a regular PDF form that I could email my co-workers for an

I opened Adobe Acrobate XI Standard to create a form. I then selected From Template, which took me to Adobe FormsCentral Online. However, I think the form is an HTML web form. All I wanted was a regular PDF form that I could email my co-workers for an internal project we're colletively working on. Now I see that FormsCentral is going away and I can't get my doc to save as a PDF without an upgrade? Help

You should be able to log into the online Formscentral Acrobat XI air app and see your doc there. From there you would need to save it out as a PDF without a submit button to have it continue to work past July. If you don't see your online form(s) please let me know the adobeID you use to log into the service as well as the form name that is missing and I will look into it for you.
Andrew

Calling a JSP Report From HTML parameter form

Hi,
I m trying to run a JSP Report from a HTML parameter Form. The JSP reports requires a parameter named userid in the URL with a valid value for database connection.
eg. URL "http://win2kdb.oracle9iis.com:7778/repdemo/examples/Tools/fm_crdinf.jsp?userid=sysapps/system@trt1". We have created a variable on the server named "parmformjsp" with a value "sysapps/system@trt1". Now i use this variable in the URL as follows, eg. "http://win2kdb.oracle9iis.com:7778/repdemo/examples/Tools/fm_crdinf.jsp?parmformjsp".
When i use this URL to call another JSP report from a JSP report it works fine, but the same does not work when calling a JSP report from a HTML form.
the code for HTML parameter form calling a report is as follows,
<html>
<head>
<meta http-equiv="Content-Language" content="en-us">
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Parameter Form</title>
</head>
<body>
<p>Parameter Form</p>
<form name="form1" method="GET"
action="http://win2kdb.oracle9iis.com:7778/repdemo/examples/Tools/fm_custrns.jsp?parmformjsp">
<p>From Date<input type="text" name="p_fmdate" size="20"></p>
<p>To Date<input type="text" name="p_todate" size="20"></p>
<p> </p>
<p><input type="submit" ><input type="reset" value="Reset" name="B2"></p>
</form>
<p> </p>
</body>
</html>
If i create an input parameter named "userid" with a valid database connection value, remove the ?parmformjsp part from the action URL then it works fine. How can i call the JSP report using the parmformjsp variable name instead of using the "userid" clause in the URL.Can anyone suggest any workaround....
Thanks & Best Regards,
Unmesh

do it like this...
DECLARE
pl_id ParamList := Get_Parameter_List('tmpdata');
BEGIN
IF NOT Id_Null(pl_id) THEN
Destroy_Parameter_List( pl_id );
END IF;
pl_id := Create_Parameter_List('tmpdata');
Add_Parameter(pl_id, 'ROUTE_CARD_CONTROL', TEXT_PARAMETER, :ROUTE_CARD.ROUTE_CARD_CONTROL);
Add_Parameter(pl_id, 'PARAMFORM', TEXT_PARAMETER, 'NO');
Run_Product(REPORTS, 'D:\STL_FINAL\CHPREPORTS_FINAL\ROUTE_CARD.REP', SYNCHRONOUS, RUNTIME, FILESYSTEM, pl_id, NULL);
END; what exactly happens when you call the report. if its showing the blank page... may be you are not passing the right parameter name. cross-check that your parameter name in the report is 'ROUTE_CARD_CONTROL'.

Fill out a pdf form from ADF application

Hi
I need to fill out a PDF form, from my ADF application and i want to know if exist a component or libarary to do this.
i hope you can help me
Regards.

Hi,
two options are:
Oracle BI Publisher (by far best choice but needs to be licenced)
http://www.oracle.com/technology/pub/articles/vohra-jdev-xmlpub.html
Jasper Reports, Free but not as functional or easy to use as BIP
http://jasperforge.org/projects/jasperreports
Both products have Java API's which you can integrate with your application.
Brenden

Stripping out html from form submissions

Similar Messages

Maybe you are looking for