Sanitize codes injection using jQuery

Question

I am using a comment box and insert the value to mysql using ajax. Same time I append the entered comment with jQuery to the same page. The problem is if the entered text is some JavaScript code, like

<script>alert('hello');</script>

it shows the alert. In my database I sanitize these code but since I append it in client side I need to display the entered text like it is.

Well I use,

<div contenteditable="true"></div>

Any immediate help, please?

Maksym Kozlenko · Accepted Answer · 2013-02-15 05:48:38Z

1

The following snippet HTML encodes string to:

"&lt;div&gt;Here is an HTML&lt;/div"


$("p").text("<div>Here is an HTML</div").html()

answered Feb 15, 2013 at 5:48

Maksym Kozlenko

10.4k2 gold badges69 silver badges55 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Jerry Jones · Accepted Answer · 2013-02-15 09:37:15Z

0

I used this method!

str.replace(/</g, "&lt;");
str.replace(/>/g, "&gt;");

answered Feb 15, 2013 at 9:37

Jerry Jones

7941 gold badge14 silver badges30 bronze badges

Collectives™ on Stack Overflow

Sanitize codes injection using jQuery

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related