html attribute name replaced by character entities

Technical Details

Forum version : #PunBB
Position : Member
Concerned browser(s) : Mozilla Firefox
Who the problem concerns : Yourself
Forum link : ( link is hidden, you must reply to see )

Description of problem

I'm trying to create a post template whose colour changes when hovered over, then reverting when the mouse is not hovered over the element. I am trying to utilise the onmouseover and onmouseout events, however the 'o's keep getting replaced by their character entities, '&#111' when the code is viewed via the inspect element developer tool of my browser, and it does not work.

for instance,

Code:

<div style="background:white" onmouseover="this.style.background='black'" onmouseout="this.style.background='white'"></div>

looks like

Code:

<div style="background:white" &#111nm&#111use&#111ver="this.style.background='black'" &#111nm&#111use&#111ut="this.style.background='white'"></div>

when submitted and viewed, thereby not allowing the color changing to occur.

I know I can use a style block with hover state selection, however I'd prefer to limit the use of that because I may use the template several times in a thread, and I don't want to slow anybody looking at the thread down, as well as a few other reasons.

thanks,

Hi @ryou,

Most if not all JavaScript methods in messages are not parsed for your security to protect your forum from XSS attacks. For this, I'd recommend adding a rule to your stylesheet to create the effect, if it's going to be used numerous times that is. For example :

Add the following to your stylesheet :

Code:

.tmp-background {
  background:#FFF;
}

.tmp-background:hover {
  background:#000;
}

Then you can use it in posts without problem, as long as you use the correct class.

Code:

<div class="tmp-background"></div>

If you're going to use multiple colors, then you'll most likely need to use multiple classes or create an inline stylesheet.

Oh okay, thanks.
I'm just a member on the forum I am using the template on, so I guess I'll opt for a non-changing background color
I guess this is solved

No problem. It is unfortunate, because we've no way to disable this, but it's for the best as anything can happen if everyone can use JavaScript in their posts.

Topic archived

Have a good day. ^^