Retaining HTML Tags

[Elso]

Hi Russell

Is there a means to include HTML tags in computed field values?
Example:

if (sFinish != '')
    {
     sListData = '<b>Finish: </b>'.sFinish;
    }

Then have the results for $sListData be:
Finish: sFinishValue
instead of
<b>Finish: </b>Mahogany (HTML: &lt;b&gt;Finish: &lt;/b&gt;Mahogany)

Nelson

[russellr]

Hi,

The short answer is: no, not at the moment.

The reason is that allowing HTML to be passed via a submitted form presents a security problem - Cross Site Scripting Vulnerability, in particular.

I know you're writing the computation code, but that doesn't stop an attacker from submitting replacement or additional computation code.

However, there will be a need to provide this feature at some stage. We'll probably go the way of "bbcode" - where you can't write HTML, but you can write some special tagging that gets translated into safe HTML code.

E.g. this is bold