#27 Issues with embedded tags in certain files.

[Anonymous]

if <script> or </script> appears in the file, and you are populating the control by using this:

function open_File(domid,fid,tlt,txt,synt)
{
var new_file= {id: fid, title: tlt, text: fix_content(txt), syntax: synt};
editAreaLoader.openFile(domid, new_file);
document.getElementById(\'edit_global\').innerHTML = "<?php lock(\'"+ fid +"\'); ?>";
}

.
.
.

$javascript = 'open_File("'
. $id
. '", "'
. $file['HC']
. '", "'
. $file['filename']
. '", "'
. slash_quote_newline($content)
. '", "'
. $syntax
. '");';
//add_onload( $javascript );
$javascript = ' function editAreaLoaded() { ' . $javascript . ' } ';
echo '<script language="javascript" type="text/javascript">' . $javascript . '</script>';

.
.
.

This will fail because the embedded tags are explored by the browser.

My work-around is to modify edit_area to use special symbol keys found in these two functions:

// called between reading a file from disk and importing via open_File into edit_area
//
// replaces all " with \" in a string
// replaces special tag code pieces with our special symbol keys
// this is needed when code is being push from mysql via php through ajax
function slash_quote_newline( $string ) {

$string = str_replace( "</", '[x-d-c-a]', $string );
$string = str_replace( "<", '[x-d-c-k]', $string );
$string = str_replace( ">", '[x-b-c-d]', $string );
$string = str_replace( "/>", '[x-b-c-e]', $string );

$string = str_replace( "\\", '\\\\', $string ); // necessary step
$string = str_replace( "\t", '\\t', $string ); // necessary step
$string = str_replace( "\n", '\\n', $string ); // necessary step
$string = str_replace( "\r", '\\r', $string ); // necessary step

return str_replace( '"', '\\"', $string ); // now replace a quote with \"
}

and then running this once the data has been imported into edit_area:

echo 'function fix_content(cc) {
var c = cc;
c = c.replace( "[x-d-c-a]", "</" );
c = c.replace( "[x-d-c-k]", "<" );
c = c.replace( "[x-d-c-d]", ">" );
c = c.replace( "[x-d-c-e]", "/>" );
c = c.replace( "\"", \'\\\"\' );
c = c.replace( "\n", "\\n" );
c = c.replace( "' . "'" . '", "\\' . "'" . '" );
c = c.replace( "\t", "\\t" );
return c;
} ';

[Nobody/Anonymous]

This was further improved via:

echo 'function fix_content(cc) {
var c = cc;
c = c.replace( "[x-d-c-a]", "</" );
c = c.replace( "[x-d-c-k]", "<" );
c = c.replace( "[x-d-c-d]", ">" );
c = c.replace( "[x-d-c-e]", "/>" );
c = c.replace( "[/aaaa1zbbb/]", "[x-d-c-a]" );
c = c.replace( "[/aaaz2bvbb/]", "[x-d-c-k]" );
c = c.replace( "[/aaza1bbxb/]", "[x-b-c-d]" );
c = c.replace( "[/azaa1bbbb/]", "[x-b-c-e]" );
c = c.replace( "\"", \'\\\"\' );
c = c.replace( "\n", "\\n" );
c = c.replace( "' . "'" . '", "\\' . "'" . '" );
c = c.replace( "\t", "\\t" );
return c;
} ';

and

// replaces all " with \" in a string
// this is needed when code is being push from mysql via php through ajax
function slash_quote_newline( $string ) {

$string = str_replace( '[x-d-c-a]', '[/aaaa1zbbb/]', $string );
$string = str_replace( '[x-d-c-k]', '[/aaaz2bvbb/]', $string );
$string = str_replace( '[x-b-c-d]', '[/aaza1bbxb/]', $string );
$string = str_replace( '[x-b-c-e]', '[/azaa1bbbb/]', $string );

$string = str_replace( "</", '[x-d-c-a]', $string );
$string = str_replace( "<", '[x-d-c-k]', $string );
$string = str_replace( ">", '[x-b-c-d]', $string );
$string = str_replace( "/>", '[x-b-c-e]', $string );

$string = str_replace( "\\", '\\\\', $string ); // necessary step
$string = str_replace( "\t", '\\t', $string ); // necessary step
$string = str_replace( "\n", '\\n', $string ); // necessary step
$string = str_replace( "\r", '\\r', $string ); // necessary step

return str_replace( '"', '\\"', $string ); // now replace a quote with \"
}

[Nobody/Anonymous]

this has been revised further:

echo 'function fix_content(cc) {
var c = cc;
c = c.replace( "/[x-d-c-a]/g", "</" );
c = c.replace( "/[x-d-c-k]/g", "<" );
c = c.replace( "/[x-d-c-d]/g", ">" );
c = c.replace( "/[x-d-c-e]/g", "/>" );
c = c.replace( "/[aaaa1zbbb]/g", "[x-d-c-a]" );
c = c.replace( "/[aaaz2bvbb]/g", "[x-d-c-k]" );
c = c.replace( "/[aaza1bbxb]/g", "[x-b-c-d]" );
c = c.replace( "/[azaa1bbbb]/g", "[x-b-c-e]" );
c = c.replace( "/\\"/g", \'"\' );
c = c.replace( "/\\\\n/g", "\\n" );
c = c.replace( "/' . "'" . '/g", "\\' . "'" . '" );
c = c.replace( "/\\\\t/g", "\\t" );
return c;
} ';

and

// replaces all " with \" in a string
// this is needed when code is being push from mysql via php through ajax
function slash_quote_newline( $string ) {

$string = str_replace( '[x-d-c-a]', '[aaaa1zbbb]', $string );
$string = str_replace( '[x-d-c-k]', '[aaaz2bvbb]', $string );
$string = str_replace( '[x-b-c-d]', '[aaza1bbxb]', $string );
$string = str_replace( '[x-b-c-e]', '[azaa1bbbb]', $string );

$string = str_replace( "</", '[x-d-c-a]', $string );
$string = str_replace( "<", '[x-d-c-k]', $string );
$string = str_replace( ">", '[x-b-c-d]', $string );
$string = str_replace( "/>", '[x-b-c-e]', $string );

$string = str_replace( "\\", '\\\\', $string ); // necessary step
$string = str_replace( "\t", '\\t', $string ); // necessary step
$string = str_replace( "\n", '\\n', $string ); // necessary step
$string = str_replace( "\r", '\\r', $string ); // necessary step

return str_replace( '"', '\\"', $string ); // now replace a quote with \"
}

slight syntax error i'm working out

[Nobody/Anonymous]

Final versions of this were:

(Creative Commons Attribute 2.0 - Herbert Elwood Gilliland III 2009

In a PHP init procedure, init_edit_area() which outputs custom callbacks and the line which includes edit_area_full.js:

echo 'function open_File(domid,fid,tlt,txt,synt)
{
var new_file= {id: fid, title: tlt, text: fix_content(txt), syntax: synt};
editAreaLoader.openFile(domid, new_file);
document.getElementById(\'edit_global\').innerHTML = "<?php lock(\'"+ fid +"\'); ?>";
}

echo 'function fix_content(cc) {
var c = cc;
c = c.replace( "[x-d-c-ax-d-c-a]", "</", "g" );
c = c.replace( "[x-d-c-kx-d-c-k]", "<", "g" );
c = c.replace( "[x-b-c-dx-b-c-d]", ">", "g" );
c = c.replace( "[x-d-c-ex-d-c-e]", "/>", "g" );
c = c.replace( "[aaaa1zbbb]", "[x-d-c-ax-d-c-a]" );
c = c.replace( "[aaaz2bvbb]", "[x-d-c-kx-d-c-k]" );
c = c.replace( "[aaza1bbxb]", "[x-b-c-dx-b-c-d]" );
c = c.replace( "[azaa1bbbb]", "[x-b-c-ex-b-c-e]" );
c = c.replace( ' . "'" . '\\\"' . "'" . ', \'"\', "g" );
c = c.replace( "\\n", "\\n", "g" );
c = c.replace( "' . "'" . '", "\\' . "'" . '", "g" );
c = c.replace( "\\t", "\\t", "g" );
return c;
} ';

// replaces all " with \" in a string
// this is needed when code is being push from mysql via php through ajax
// editor will never work with a file that contains this function:
function slash_quote_newline( $string ) {

$string = str_replace( '[x-d-c-ax-d-c-a]', '[aaaa1zbbb]', $string );
$string = str_replace( '[x-d-c-kx-d-c-k]', '[aaaz2bvbb]', $string );
$string = str_replace( '[x-b-c-dx-b-c-d]', '[aaza1bbxb]', $string );
$string = str_replace( '[x-b-c-ex-b-c-e]', '[azaa1bbbb]', $string );

$string = str_replace( "</", '[x-d-c-ax-d-c-a]', $string );
$string = str_replace( "<", '[x-d-c-kx-d-c-k]', $string );
$string = str_replace( ">", '[x-b-c-dx-b-c-d]', $string );
$string = str_replace( "/>", '[x-b-c-ex-b-c-e]', $string );

$string = str_replace( "\\", '\\\\', $string ); // necessary step
$string = str_replace( "\t", '\\t', $string ); // necessary step
$string = str_replace( "\n", '\\n', $string ); // necessary step
$string = str_replace( "\r", '\\r', $string ); // necessary step

return str_replace( '"', '\\"', $string ); // now replace a quote with \"
}

The above functions are to be called during the header portion of a php file but, with a few corrections, could be in an HTML block inside a <script> tag. Data originates as a PHP string to provide a way to interface with the rest of the webservice, including the MySQL database which directs us to the file.

Submitted sample:

/* Create a hypertext link which will open the target in a given multi-view Edit Area editor.
*
* link_name can contain additional html
* fid: file id in database
* editor_domid: id of the edit area context
* file_domid: target id of the new file
* content: the text content block of the file
* syntax_by_file_extension: determines syntax highlighting method
* short_name: alternate to link_name to appear inside editor as the title of the new window (usually filename)
*/
function editLink( $link_name, $fid, $editor_domid, $content, $syntax_by_file_extension, $short_name="" ) {
$name_hash = "F" . hash_temp(30);
if ( $short_name == "" ) $short_name=$link_name;
return
"<script type=\"text/javascript\" language=\"javascript\"> function "
. $name_hash . '() { open_File("' . $editor_domid . '", "'
. $fid . '", "'
. $link_name . '", "'
. slash_quote_newline(($content)) . '", "'
. $syntax_by_file_extension . '"); '
. " }; "
."</script>"
. '<a href="javascript:' . $name_hash . '()">' . $link_name . '</a>';
}

Called on the content which is retrieved from a server document or provided in another way such as a MySQL query, or a generator of what needs to be written in the content of the <textarea> if you choose to do manual content involving special characters such as HTML tags, etc.

// Destroys html tags temporarily
// Tries to hide from itself (when reading its own source code)
// replaces all " with \" in a string
// this is needed when code is being push from mysql via php through ajax
// editor will never work with a file that contains this function:
function slash_quote_newline( $string ) {

$string = str_replace( '[x-d-c-ax-d-c-a]', '[aaaa1zbbb]', $string );
$string = str_replace( '[x-d-c-kx-d-c-k]', '[aaaz2bvbb]', $string );
$string = str_replace( '[x-b-c-dx-b-c-d]', '[aaza1bbxb]', $string );
$string = str_replace( '[x-b-c-ex-b-c-e]', '[azaa1bbbb]', $string );

$string = str_replace( "</", '[x-d-c-ax-d-c-a]', $string );
$string = str_replace( "<", '[x-d-c-kx-d-c-k]', $string );
$string = str_replace( ">", '[x-b-c-dx-b-c-d]', $string );
$string = str_replace( "/>", '[x-b-c-ex-b-c-e]', $string );

$string = str_replace( "\\", '\\\\', $string ); // necessary step
$string = str_replace( "\t", '\\t', $string ); // necessary step
$string = str_replace( "\n", '\\n', $string ); // necessary step
$string = str_replace( "\r", '\\r', $string ); // necessary step

return str_replace( '"', '\\"', $string ); // now replace a quote with \"
}

[Nobody/Anonymous]

A note on that last bit of code (message below) -- you must also write the inversions of fix_content and slash_quote_newline and use them to push back to php.

[Nobody/Anonymous]

the routines below were updated once again

// replaces all " with \" in a string
// this is needed when code is being push from mysql via php through ajax
// editor will never work with a file that contains this function:
function to_js( $string ) {

$string = str_replace( '[x-d-c-ax-d-c-a]', '[aaaa1zbbb]', $string );
$string = str_replace( '[x-d-c-kx-d-c-k]', '[aaaz2bvbb]', $string );
$string = str_replace( '[x-b-c-dx-b-c-d]', '[aaza1bbxb]', $string );
$string = str_replace( '[x-b-c-ex-b-c-e]', '[azaa1bbbb]', $string );

$string = str_replace( "</", '[x-d-c-ax-d-c-a]', $string );
$string = str_replace( "<", '[x-d-c-kx-d-c-k]', $string );
$string = str_replace( ">", '[x-b-c-dx-b-c-d]', $string );
$string = str_replace( "/>", '[x-b-c-ex-b-c-e]', $string );

$string = str_replace( "\\", '\\\\', $string ); // necessary step
$string = str_replace( "\t", '\\t', $string ); // necessary step
$string = str_replace( "\n", '\\n', $string ); // necessary step
$string = str_replace( "\r", '\\r', $string ); // necessary step

return str_replace( '"', '\\"', $string ); // now replace a quote with \"
}

// replaces all " with \" in a string
// this is needed when code is being push from mysql via php through ajax
// editor will never work with a file that contains this function:
function from_js( $string ) {

$string = str_replace( '[aaaa1zbbb]', '[x-d-c-ax-d-c-a]', $string );
$string = str_replace( '[aaaz2bvbb]', '[x-d-c-kx-d-c-k]', $string );
$string = str_replace( '[aaza1bbxb]', '[x-b-c-dx-b-c-d]', $string );
$string = str_replace( '[azaa1bbbb]', '[x-b-c-ex-b-c-e]', $string );

$string = str_replace( '[x-d-c-ax-d-c-a]', "</", $string );
$string = str_replace( '[x-d-c-kx-d-c-k]', "<", $string );
$string = str_replace( '[x-b-c-dx-b-c-d]', ">", $string );
$string = str_replace( '[x-b-c-ex-b-c-e]', "/>", $string );

$string = str_replace( '\\"', '"', $string );
$string = str_replace( '\\t', "\t", $string ); // necessary step
$string = str_replace( '\\n', "\n", $string ); // necessary step
$string = str_replace( '\\r', "\r", $string ); // necessary step
$string = str_replace( '\\$', "$", $string ); // necessary step
$string = str_replace( '\\\\', "\\", $string ); // necessary step

return $string; // now replace a quote with \"
}

echo '<script language="Javascript" type="text/javascript">';

echo 'function from_php(cc) {
var c = cc;
c = c.replace( "[x-d-c-ax-d-c-a]", "</", "g" );
c = c.replace( "[x-d-c-kx-d-c-k]", "<", "g" );
c = c.replace( "[x-b-c-dx-b-c-d]", ">", "g" );
c = c.replace( "[x-d-c-ex-d-c-e]", "/>", "g" );
c = c.replace( "[aaaa1zbbb]", "[x-d-c-ax-d-c-a]" );
c = c.replace( "[aaaz2bvbb]", "[x-d-c-kx-d-c-k]" );
c = c.replace( "[aaza1bbxb]", "[x-b-c-dx-b-c-d]" );
c = c.replace( "[azaa1bbbb]", "[x-b-c-ex-b-c-e]" );
c = c.replace( "\\\\\\\\", "\\\\", "g" );
c = c.replace( ' . "'" . '\\\"' . "'" . ', \'"\', "g" );
c = c.replace( "\\\\n", "\n", "g" );
c = c.replace( "\\\\t", "\t", "g" );
c = c.replace( "\\\\r", "\r", "g" );
return c;
} ';

echo 'function to_php(cc) {
var c = cc;
c = c.replace( "</", "[x-d-c-ax-d-c-a]", "g" );
c = c.replace( "<", "[x-d-c-kx-d-c-k]", "g" );
c = c.replace( ">", "[x-b-c-dx-b-c-d]", "g" );
c = c.replace( "/>", "[x-d-c-ex-d-c-e]", "g" );
c = c.replace( "[x-d-c-ax-d-c-a]", "[aaaa1zbbb]", "g" );
c = c.replace( "[x-d-c-kx-d-c-k]", "[aaaz2bvbb]", "g" );
c = c.replace( "[x-b-c-dx-b-c-d]", "[aaza1bbxb]", "g" );
c = c.replace( "[x-b-c-ex-b-c-e]", "[azaa1bbbb]", "g" );
c = c.replace( "\\\\", "\\\\\\\\", "g" );
c = c.replace( "\n", "\\\\n", "g" );
c = c.replace( "\\t", "\\\\t", "g" );
c = c.replace( "\\r", "\\\\r", "g" );
c = c.replace( \'"\', ' . "'" . '\\\\"' . "'" . ', "g" );
c = c.replace( "$", "\\\\$", "g" );
return c;
} ';