Question

I had just fixed a bunch of issues I was having in some forms that contained rich text editors (CK Editor) and getting XSS errors (“Potentially dangerous script…”). It was all working after setting the editors to HTML encode output.

Then I switched my submit buttons (<input type=submit />) to anchor tags with a javascript submit (<a href="#" onclick="document.forms['formName'].submit();">submit</a>) and it started giving me the errors again.

Somehow it seems the javascript submit doesn’t cause the encoding to take place. Does anyone know why this might be happening and how I could fix it?

Answer 1

Try setting the htmlEncodeOutput property first.