Home/ Questions/Q 7420581
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-29T08:15:49+00:00

Is there any way to setup Firefox and Chrome to work with escape=false attribute

  • 0

Is there any way to setup Firefox and Chrome to work with escape=false attribute in h:outputText tag. When there is some html that needs to be shown in the browser, Firefox and Chrome show parsed string correctly, but any other links in application are freezed (??).

The example html from db:

<HEAD>
<BASE href="http://"><META content="text/html; charset=utf-8" http-equiv=Content-Type>          
<LINK rel=stylesheet type=text/css href=""><META name=GENERATOR content="MSHTML 9.00.8112.16434">
</HEAD>
<BODY><FONT color=#000000 size=2 face="Segoe UI">läuft nicht</FONT></BODY>

Parsed HTML on the page:

läuft nicht

What is very weird, is that in IE everything works (usually it is opposite).

I use primefaces components (v2.2), .xhtml, tomcat 7 and JSF 2.0

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You end up with syntactically invalid HTML this way:

    <html>
    <head></head>
    <body>
        <head></head>
        <body>...</body>
    </body>
</html>

    This is not right. There can be only one <head> and <body>. The browsers will behave unspecified. You need to remove the entire <head> and the wrapping <body> from that HTML so that you end up with only

    <FONT color=#000000 size=2 face="Segoe UI">läuft nicht</FONT>

    You’d need to either update the DB to remove unnecessary HTML, or to use Jsoup to parse this piece out on a per-request basis something like as follows:

    String bodyContent = Jsoup.parse(htmlFromDB).body().html();
// ...

    Alternatively, you could also display it inside a HTML <iframe> instead with help of a servlet. E.g.

    <iframe src="htmlFromDBServlet?id=123"></iframe>

    Unrelated to the concrete problem:

    1. Storing HTML in a DB is a terrible design.
    2. If the HTML originates from user-controlled input, you’ve a huge XSS attack hole this way.
    3. The <font> tag is deprecated since 1998.
    • 0