ansaurus

Question

Answer 1

+12 A:

I use the following method:

function htmlDecode(input){
  var e = document.createElement('div');
  e.innerHTML = input;
  return e.childNodes[0].nodeValue;
}

htmlDecode("&lt;img src='myimage.jpg'&gt;"); 
// returns "<img src='myimage.jpg'>"

Basically I create a DOM element programmatically, assign the encoded HTML to its innerHTML and retrieve the nodeValue from the text node created on the innerHTML insertion.

It will work cross-browser accepting all the HTML Character Entities.

CMS 2009-12-16 05:33:29

Got it, you changed to ', so let me delete my comment back, thx, its working great, +1

S.Mark 2009-12-16 05:41:36

@S.Mark: `'` doesn't belongs to the HTML 4 Entities, that's why! http://www.w3.org/TR/html4/sgml/entities.html http://fishbowl.pastiche.org/2003/07/01/the_curse_of_apos/

CMS 2009-12-16 05:48:16

Oh, Thats great to know that, thanks for info.

S.Mark 2009-12-16 05:49:14

See also @kender's note about the poor security of this approach.

Joseph Turian 2009-12-16 20:52:24

See my note to @kender about the poor testing he did ;)

Roatin Marth 2009-12-16 21:08:26

Also, nice answer.

Roatin Marth 2009-12-16 21:09:02

Answer 2

+1 A:

Not a direct response to your question, but wouldn't it be better for your RPC to return some structure (be it XML or JSON or whatever) with those image data (urls in your example) inside that structure?

Then you could just parse it in your javascript and build the <img> using javascript itself.

The structure you recieve from RPC could look like:

{"img" : ["myimage.jpg", "myimage2.jpg"]}

I think it's better this way, as injecting a code that comes from external source into your page doesn't look very secure. Imaging someone hijacking your XML-RPC script and putting something you wouldn't want in there (even some javascript...)

kender 2009-12-16 05:34:33

Does the @CMS approach above have this security flaw?

Joseph Turian 2009-12-16 06:30:44

I just checked the following argument passed to htmlDecode fuction: htmlDecode("<img src='myimage.jpg'><script>document.write('xxxxx');</script>") and it creates the <script></script> element that can be bad, imho. And I still think returning a structure instead of text to be inserted is better, you can handle errors nicely for example.

kender 2009-12-16 07:06:13

I just tried `htmlDecode("<img src='myimage.jpg'><script>alert('xxxxx');</script>")` and nothing happened. I got the decoded html string back as expected.

Roatin Marth 2009-12-16 21:05:44

Answer 3

+5 A:

If you're using jQuery:

function htmlDecode(value){ 
  return $('<div/>').html(value).text(); 
}

Otherwise, use Strictly Software's Encoder Object, which has an excellent htmlDecode() function.

cxfx 2009-12-16 05:40:02

ansaurus

tags:

views:

answers:

Unescape HTML entities in Javascript?

related questions