CODEWITHSUNDEEP
phpjqueryhtmlforms
gerpaick
gerpaick

Reputation: 799

html textarea html tags missed after send form in IE only

i have this problem: i have a form with textarea field, and on a onSumbit, i copy content of a div with table to this textarea field.

when i send this form and i send an email with these values in IE i get plain text not formatted. i have tested with Chrome, Firefox, Opera, Safari and i get formatted table. Only IE is not working.

my form begins with:

<form name="form" action="sendmail.php" method="post" onsubmit="formVal()" >

on onSubmit i set text area value with this:

$("#value2").html($("#spReport").html());

and in php script o get value with:

$message = "    
<p><b>Summary: </b><br />" . $_POST['value2'] . " .</p>";

then i send this via email.

with Chrome, Firefox, Safari, Opera is working, I get email with table formatted. Only IE gives me this problem. I have checked under IE with Developer Tools, and value of textarea value2 is filled with formatted table (with html tags).

any ideas what can be wrong?

Upvotes: 0

Views: 501

Answers (2)

Blank
Blank

Reputation: 7208

I'm nearly certain that Internet Explorer is automatically escaping the html because you're submitting it as part of a textbox. I'm actually surprised the other browsers aren't doing this for you as well-- standard or not, it's a great way to prevent XSS attacks.

What should "fix" the problem for you would be to call htmlspecialchars_decode() on the field in php before sending the email. (This won't do anything for browsers that aren't automatically escaping, and should fix the escaping that IE does.)

That said, might I suggest not relying on HTML sent from the client? A much better solution would be to generate the table in PHP and avoid accepting HTML from the client, which is just asking for an injection. At the very least, make sure you're sanitizing your html before emailing it.

Upvotes: 1

justacoder
justacoder

Reputation: 2704

How you're setting the value of the textarea may have an affect on this, too. You should set the value by:

$("#value2").val( $("#spReport").html() );

Using .html() (and even .text()) should only be applied to tags, specifically. .val() is used primarily for setting form field variables. Of course, they're interchangeable but you don't know what side effects may occur.

Upvotes: 1

Related Questions