views:

98

answers:

4

I need a way to identify certain strings in HTML markup. I know what the strings are, but it is possible that they could be substrings of other strings in the document. To find them, I output a special delimiter character (currently using \032). On page load, we go through the HTML and record the location of the strings, and remove the delimiter.

Unfortunately, most browsers show the delimiter character until we can find and remove them all. I'd like to avoid that if possible. Is there a character or string that will be preserved in the HTML content (so a comment wont work) but wont be visible to the user? It also needs to be something that is fairly unlikely to appear next to a string, so something like   wouldn't work either.

EDIT: Sorry, I forgot to mention that the strings will be in attributes, so any sort of tag wont work.

+4  A: 
amphetamachine
Vertical tab! That's a good one. I'll try that.
noah
Windows never used carriage return without a new line after it; it always uses both in succession. You're thinking of old Macs.
Michael Madsen
So the problem with whitespace characters is that the DOM will normalize and otherwise mess with them, so they can't be reliably found later. VTs tend to get converted to spaces in the DOM.
noah
@Michael Madsen - That's what I meant; as `foo\x{0d}\x{0a}bar` is the Windows-standard line formatting method and would not match `/\x0d(?[^\x0a]*)\x0d`. Kudos on recalling the old Mac encoding! Ever tried `type`-ing a file in that encoding on a Windows terminal? Prints all on one line! :-)
amphetamachine
+2  A: 

The best thing that I shall like to insert, which is not visible on the browser, will be a pair of tags with some special id, like <span id="delimiter" class="Delimiter"></span>. This will not show up on the content, while this can be present in the doc. You don't need to remove them.

Kangkan
Sorry, forgot to mention that the strings appear in attributes too, so the tags will end up encoded.
noah
+3  A: 

&zwnj; - zero-width non-joiner (see http://htmlhelp.org/reference/html40/entities/special.html)

On the off chance that this already appears in your text, double it up (eg: &zwnj;&zwnj;mytext&zwnj;&zwnj;


Edit in response to comment: works in Firefox 3. Note that you have to search for the Unicode value of the entity.

<html>
<body>
    <div id="test">
        This is a &zwnj;test
    </div>

    <script type="application/javascript">
        var myDiv = document.getElementById("test");
        var content = myDiv.innerHTML;
        var pos = content.indexOf("\u200C");
        alert(pos);
    </script>
</body>
</html>
Anon
Good idea, but that entity doesn't show up in the innerHTML, so I can't actually find it.
noah
Perfect! That code does the trick.
noah
A: 

You could use LTR marks. Is this for some sort of XSS testing? If so, this might be of interest: Taint support for PHP

Tgr
Not XSS realated. What are LTR marks?
noah
They mark left-to-right writing direction in Unicode. They have no effect when the language is left-to-right anyway.
Tgr