why use htmlencode

Hi

I have a website where people can enter comments into a textarea - some of
these may have a bit of html - like links - or <blockquote>

the comments are stored in a Access2000 mdb file - A friend told me that i
have to use htmlencode on the textarea string before storing it in the
database. but it seems to work fine without doing this - is there any reason
as to why i should put it thru htmlencode?

when the comments are displayed they are written straight into a <div>

<div><%=recset.fields("comments")%></div>

thanks in advance

Diablo

Aaron
Thu Jul 07 13:46:47 CDT 2005

No, IMHO you should use HTMLEncode when placing it INTO the textarea (e.g.
for edit) and when displaying if you don't want any of the HTML to actually
render as intended. Again, IMHO, it should be stored as entered, and only
converted when displaying. I'd be curious about your friend's reason(s)
about having to store it in HTMLEncoded format.




"diablo" <diablo@noplace.com> wrote in message
news:cGeze.2080$f77.1747@newsfe2-gui.ntli.net...
> Hi
>
> I have a website where people can enter comments into a textarea - some of
> these may have a bit of html - like links - or <blockquote>
>
> the comments are stored in a Access2000 mdb file - A friend told me that i
> have to use htmlencode on the textarea string before storing it in the
> database. but it seems to work fine without doing this - is there any
> reason
> as to why i should put it thru htmlencode?
>
> when the comments are displayed they are written straight into a <div>
>
> <div><%=recset.fields("comments")%></div>
>
> thanks in advance
>
> Diablo
>
>
>

diablo
Thu Jul 07 18:22:16 CDT 2005


> when displaying if you don't want any of the HTML to actually
> render as intended. Again, IMHO, it should be stored as entered,

I am a simple soul and may have misinterpreted my friends advice - but what
you are saying is that, ignoring the case of editing, I do not need to use
htmlencode?

I found this tip

http://www.devx.com/tips/Tip/13459

but i guess i can ignore it since if i store raw html in the db then i wont
have

&amp;

type characters in my DB.

Is my thinking correct?


> and only
> converted when displaying.

Here you mean displaying for editing not for rendering dont you?

TIA

D

Aaron
Thu Jul 07 18:47:17 CDT 2005

> if i store raw html in the db then i wont have
>
> &amp;
>
> type characters in my DB.

Correct. It will just be &

> > and only
> > converted when displaying.
>
> Here you mean displaying for editing not for rendering dont you?

No, I meant what I said. You trimmed some of it, but it *needs* to be
converted before being inserted into a textarea for editing. How you want
to handle rendering is up to you.

Do you want <a href=foo>link</a> to look exactly as it does in this message?
Then HTMLEncode it.

Do you want <a href=foo>link</a> to work as an active link when rendered?
Then do not HTMLEncode it.

diablo
Fri Jul 08 01:38:33 CDT 2005


> No, I meant what I said. You trimmed some of it, but it *needs* to be
> converted before being inserted into a textarea for editing. How you want
> to handle rendering is up to you.
>
> Do you want <a href=foo>link</a> to look exactly as it does in this
message?
> Then HTMLEncode it.
>
> Do you want <a href=foo>link</a> to work as an active link when rendered?
> Then do not HTMLEncode it.
>
Ah... penny has dropped.

Thanks for your help

D