Question

I’m using sharepoint 2007.

I have a list called “User Tickets” with one column called “Content”

My problem is that I’m trying to insert the following text :

<script type=\"text/javascript\"> </script>

To avoid exception I Used ‘HtmlEncode’

But, sharepoint ignores this and just insert a blank value to the ‘content’ column.

My Code:

ListsSoapClient _proxy = new ListsSoapClient();

string ContentValue = 
HttpContext.Current.Server.HtmlEncode("<script type=\"text/javascript\"> </script>");

XmlDocument doc = new XmlDocument();

XmlElement batchElement = doc.CreateElement("Batch");

batchElement.InnerXml = "<Method ID=\"1\" Cmd=\"New\"> <Field Name=\"Ticket_x0020_Details\">ContentValue </Field></Method>";

_proxy.UpdateListItems("User Tickets", UtilHelper.GetXElement(batchElement));

How can I get sharepoint to accept thisvalue: <script type=\"text/javascript\"> </script>?

Answer 1

SharePoint has some sort of user content filtering. It depends on the column you are inserting into. What is its type? If it is rich text, SharePoint will not allow script content to be inserted.

Upd: The idea of filtering out scripts is quite natural. Imagine, if that were allowed, what would happen when you opened “AllItems.aspx” view and all the scripts were executed.

What you can do, is you can double encode the contents, so that <script> in the source code becomes <script> in your ContentValue field. This way, your script will be saved into the list item as text. To execute it as script, you will always have to to call HtmlDecode.