The Importance of HTMLEditFormat()

Posted At : August 23, 2007 5:46 PM | Posted By : Joe Danziger
Related Categories: ColdFusion

I got a call today from a user who was having a weird problem when trying to save data on a form. Upon inspection, it turned out that there were a set of double-quotes in the data.

So why is this a problem? As far as ColdFusion cares, it's not, and the data was actually getting saved to the database correctly. The problem appeared when doing an edit. Everything after the first double-quote was being cutoff.

Upon further inspection of the HTML being generated, it seems that is where the problem came in. ColdFusion was doing it's job by outputting the double-quotes, with no knowledge of where in the page that data is being used. And if you use it in a form, you've got problems because it will appear to the user that the data is not saving.

The solution is to use HTMLEditFormat() when outputting values into form fields. This will cause any HTML special characters to change to their entity notations. So the HTML that is generated will actually look something like this:

1 <input type="text" name="whatever" value="some "quoted" text" />

but it will display on the form as normal double-quotes, and will submit as that too:

This may be common knowledge to many of you, but I'd bet there's a whole bunch of developers who don't even realize this could be an issue. Hopefully this will help prevent some hard-to-track bugs!

Comments (5) |

Send |

del.icio.us |

Digg It! |

Linking Blogs | 6065 Views

TweetBacks

Comments

Great post -
Yes I'm amazed at the projects that I am on where they don't take that into account when building forms. It's also worth noting, that when you're using the cfinput suite of tags, you don't have to worry about htmleditformat() as it's built into the tag.

Thanks!

# Posted By Kevin Penny | 8/24/07 9:50 PM

Great post!

# Posted By Joshua Rountree | 11/13/07 11:57 PM

I just ran across this same problem with an app someone else wrote. This function solved the issue quickly.

# Posted By Jeff | 1/14/08 1:36 PM

I have run into a separate, but similar problem: If I use htmlEditFormat() to re-edit the form multiple times, I've had the & be encoded multiple times. &&& etc. Has anyone else run into this? How do you prevent it?

# Posted By Dan Sorensen | 6/25/08 11:41 AM

Just do it when outputting to the screen, not when inserting/updating
data in the database otherwise you'll get the double knock-on effect.

# Posted By Andrew | 6/4/09 10:33 AM

RSS

Calendar

Sun	Mon	Tue	Wed	Thu	Fri	Sat
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30	31

Enter your email address to subscribe to this blog.