textarea & &

why does it display differently when in ASP tags <% %>

[joshie76]

try this...

<textarea id="testtext" style="width:600px;height:500px">
<% &amp; %>
<! &amp; !>
< &amp; >
&amp;
</textarea>

and explain to me why (in IE) it displays literally when between the <%ASP%> tags and as an entity elsewhere? It also does the same if you put it in comment tags <!-- &amp; -->.

Any ideas? I'm reluctant to write a script that checks whether it's inside ASP tags, could end up being a real nightmare.

[joshie76]

just tried it in some other browsers...

Opera and NN4 show entities (&) in all cases, Netscape 6 shows entities in all cases except in comments tag where it shows literally (&amp;)

maybe it's a DOM thing with IE going a bit further for ASP (since it's their's!) but it doesn't make any sense to me.

[joshie76]

well I've found a fix...

replace your

<%

and

<!--

with

<%

and

<!--

.

This seems to work fine and sends up the correct character '<' to the server. I'm guessing that the totally correct method would be to HTML encode (Server.HTMLencode) everything inside a textarea.

Josh

[toadhall]

Joshie

Just a guess, in the middle of this morning's first cup of coffee, but if it's happening in IE only it could have something to do with VB Script.

?

[joshie76]

Cheers toadhall,

It shouldn't be, client side VBScript is marked up just like JScript:
<script type="text/vbscript">...</script>. ASP tags <% are purely for server scripts.

I've now used Server.HTMLencode() (in ASP on the server) on the entire contents of the textarea and it works a treat. I'm guessing that, strictly speaking, you should never have a <, > or an & inside <textarea> tags, so if they start behaving oddly you know where to look.

Does anyone know if this assumption is correct? Should your <input type="text" value="value"> value be HTML encoded too?