I have a page containing a table to which values can be added via a textbox in a modal popup and the values will appear in the table on the page. It is being tested by adding the string ); to the textbox and it fails because this string will initiate a popup. So I need to allow this code to be added and appear innocuously in its original format on the page without initiating a popup etc. I've tried HTMLDecode('user added string') but this just cleanses the string and returns ); Is there a way to do this?
This is the table so the string is just being plonked in a cell so maybe something like a Literal would help? But it has to be done client side - there is no server involvement. I don't know how the code is initiated as someone else messed with that but it makes a raptor run across the screen - ridiculous.
<table>
<thead>
<tr>
<th>Event</th>
<th>Target Day(s)</th>
<th></th>
<th></th>
</tr>
</thead>
<tbody>
<tr>
<td>));</Script><Script Src="//donastystuff1/X.Js"/></td>
<td>1</td>
<td></td>
<td></td>
</tr>
</tbody>
Thanks for the input but I fixed it by adding the string to a Literal manually like this
var thisEventType = 'malicious string';
var $thisEventTypeCell = $('<td><asp:Literal id="litEventType" runat="server">' + '</asp:Literal></td>');
$thisEventTypeCell.text(thisEventType);
tr.append($thisEventTypeCell);