Sunday, February 15, 2009

Note Field Removes Script (and Inline Style) When Saving

I have been using a "Multiple lines of text" field (a note field) to store some HTML. Testing revealed that the HTML in the field was not quite the same as intended.

Further investigation showed that when a list item with note fields is saved, any blocks of text that resemble script are removed from the rich text in the note fields. This occurs either when saving the item through a form in the browser, or when using the "update()" API method.

The process that removes script sometimes gets too eager to "cleanse" the HTML - I found that it was removing the following inline style (not my HTML design, I hasten to add!):

BACKGROUND-IMAGE: url(http://some.site/info/communications/PublishingImages/box_1024.gif);

I didn't experiment further with this style to see whether adjusting the exact text (for example, adding quotes) might mean it was retained.

No comments: