• I like this plugin fairly well, but I don’t think I can use it because it looks like it doesn’t sanitize HTML in its textareas.

    For instance, if you put
    <b>This is going to be bold</b> in the textarea, then in the email that is sent to the administrator, the text is bold, instead of showing the bold tags. Since text that people enter could contain HTML or HTML special characters, it would be nice if these characters were encoded before being sent in the email.

    I didn’t try this with normal text fields, but I have a feeling that they may have the same issue.

    I hope that this can be fixed, and thank you for taking the time to read this 🙂

    https://wordpress.org/plugins/contact-form-builder/

Viewing 13 replies - 1 through 13 (of 13 total)
  • Plugin Contributor webdorado

    (@webdorado)

    Dear wyrmmage,

    Please note, co to your form > Form Options > E-mail options > Mode and set it to Text. That way you will achieve what you described.

    Thank you.

    Thread Starter wyrmmage

    (@wyrmmage)

    webdorado, thank you; that’s good to know. I think it would still be nice to be able to sanitize just the tokens (if that’s what you call them? Things like %all%), though.

    Plugin Contributor webdorado

    (@webdorado)

    Dear wyrmmage,
    Please be informed, that %all% generates the data in the text mode as well. Could you please tell us what you are pointing to more in details?
    Thank you.

    Thread Starter wyrmmage

    (@wyrmmage)

    Well, what I meant was that it would be nice if HTML characters in tokens (like %all%) were sanitized when outputted in an HTML email.

    For instance, let’s say that someone puts in your contact form the below code.

    Hey, I'm having some issues with the HTML that you sent me. I've been putting this code in for the image, but I can't get it working :\
    
    <img src="someImage.png">

    and then your email template looks like this:

    You’ve received an email!
    %all%

    The end result is that the email will be sent with the image HTML embedded directly into the email, and the email client will likely render the image or strip it for safety reasons, instead of displaying what was originally entered in the form. It would be nice if instead the tokens were run through something that converted HTML special characters into HTML entities, so the resulting email would be something like this:

    You’ve received an email!
    Hey, I’m having some issues with the HTML that you sent me. I’ve been putting this code in for the image, but I can’t get it working :\

    &lt;img src=”someImage.png”&gt;

    When the email client would render the above code, then it would turn the entities back into normal characters, so that the text that was shown in the email would look like the text that was originally put in the form 🙂

    Does that help at all? If not, I can try to explain it in more detail or in a different way.

    Plugin Contributor webdorado

    (@webdorado)

    Dear wyrmmage,

    Please install the latest version of Form Maker. For security conserns the HTML is being converted to HTML special characters. However, when you add an HTML code from the editor, it will appear as a code.

    Thank you

    Thread Starter wyrmmage

    (@wyrmmage)

    I’ve tried installing the latest version, but I’m afraid it still has the same issue. Would you mind trying it out by copying

    Hey, I'm having some issues with the HTML that you sent me. I've been putting this code in for the image, but I can't get it working :\
    
    <img src="someImage.png">

    into a textarea in the form and then emailing it to yourself in HTML mode? With me, the HTML is interpreted, instead of being shown.

    Plugin Contributor webdorado

    (@webdorado)

    Dear wyrmmage,

    Please note, that this is the default setting of Form Maker, and the elements are sent this way due to security concerns. You can get the HTML code working, if you add the image to the field editor.

    But if you want it working in the e-mail, please contact us to info@web-dorado.com and we will send you a customized package.

    Thank you.

    Thread Starter wyrmmage

    (@wyrmmage)

    Hehe, I think we’re talking past each other a bit 🙂

    What I’m trying to say is that I think that the fields are [i]not[/i] being HTML encoded, as when I input HTML in a form field (as the end user), it [i]does[/i] work, when it should not.

    If you try taking this code

    Hi there, I'm trying to contact you about an issue.
    
    <b>This should not show up as bold in the email, but in my case, it does.</b>

    and paste it into a textarea in the form, then at least for me, the text that’s in the bold tags is bold inside the email.

    Does that help at all?

    Thank you 🙂

    Plugin Contributor webdorado

    (@webdorado)

    Dear wyrmmage,

    We understood your requirement. We can send you a customized version, that will accomplish this.

    As mentioned before, the HTML tags added to the form fields are being encoded due to security concerns. Please contact us to info@web-dorado.com, and we will send you a version, that does not encode the tags.

    Thank you.

    Thread Starter wyrmmage

    (@wyrmmage)

    Hehe, what I’m trying to say is that the HTML tags added to the form fields are [b]not[/b] being encoded.

    Plugin Contributor webdorado

    (@webdorado)

    Dear wyrmmage,

    Please update your Form Maker to the latest version. If this action does not solve the problem, please contact us to info@web-dorado.com.

    Thank you.

    Thread Starter wyrmmage

    (@wyrmmage)

    webdorado,

    As I mentioned above, I’ve already installed the latest version, and it still has the issue.

    Would it be possible to continue discussion here? I’d rather do that than have to start a new chain of communication, if possible.

    Thank you,
    Eli

    Plugin Contributor webdorado

    (@webdorado)

    Dear wyrmmage,

    Could you please give us a link to a webpage where you have a form? We need a form, that has an e-mail field and sends a message to a submitter. This way we will test and see what we are getting in the e-mail content.

    Thank you.

Viewing 13 replies - 1 through 13 (of 13 total)
  • The topic ‘Doesn't sanitize HTML in textareas’ is closed to new replies.