1

I want to insert html and JavaScript code with textarea field in my database. Problem is code has inserted but its replaced all double question with backlash. How to insert this code with textarea.

<div id="TA_cdsratingsonlynarrow539" class="TA_cdsratingsonlynarrow"><ul id="Ny62NY" class="TA_links r04zlbt"><li id="jb9xdEapRG" class="sc9nmfeVX"><a target="_blank" href="https://www.tripadvisor.com/"><img src="https://www.tripadvisor.com/img/cdsi/img2/branding/tripadvisor_logo_transp_340x80-18034-2.png" alt="TripAdvisor"/></a></li></ul></div><script src="https://www.jscache.com/wejs?wtype=cdsratingsonlynarrow&amp;uniq=539&amp;locationId=671932&amp;lang=en_US&amp;border=false&amp;shadow=false&amp;display_version=2"></script>

1
  • This answer might be helpful. Commented Aug 6, 2017 at 9:33

1 Answer 1

0

It is possible to insert/inject html and javascript code using textarea input field into the current page.

consider, you've following textarea:

<div id="output"></div>
<div style="margin: 25px auto; width: 80%; height: auto;">
    <form id="myform" name="myform">
        <textarea id="mytextarea" name="mytextarea" cols="90" rows="20"></textarea>
        <br> <button type="button" id="mybutton">execute</button>
    </form>
</div>

Now, you can add event listener to that above button to extract html and javascript code from the textarea and insert them to the page:

    window.addEventListener('load', function () {
        document.getElementById('mybutton').addEventListener('click', function (e) {
            var mytextarea = document.getElementById('mytextarea');
            var pattern = /<script>([^]+?)<\/script>/mg;
            var matches, txt = mytextarea.value;
            if (txt) {
                while (matches = pattern.exec(txt)) {
                    if (matches[1]) {
                        var tContent = matches[1].replace(/(\n|\r)+/gm, '');
                        var s = document.createElement('script');
                        s.innerText = tContent;
                        document.body.appendChild(s);
                    }
                }
                txt = txt.replace(pattern, '');
            }
            if (txt) {
                document.getElementById('output').innerHTML = txt;
            }
        });
    });
Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.