Develop Reference

How can I disable js in an input textbox?

I have input type text, when writing js in input field <script> alert (1) </script> it works, is it possible to disable js in input?
Thanks
<form action="" name="typing_and_press_form" id="typing_and_press_form">
<input id='typing_and_press' class="typing_and_press" type="text"
placeholder="<?php if($jobStrings) echo $jobStrings['keyword_search']; ?>">
<div class="tagsgroupkeyup"></div>
</form>
jquery:
jQuery('#typing_and_press_form').on('submit', function (event) {
event.preventDefault();
if (jQuery('#typing_and_press').val()){
var enteredValue = jQuery('#typing_and_press').val();
jQuery('.typing-press .tagsgroupkeyup').append('<div class="tagstyle"><span>' + enteredValue + '</span><span id="' + enteredValue + '" class="remove">X</span></div>');
jQuery('#typing_and_press').val('');
jQuery('#typing_and_press').text('');
}
})

This is known as a self-xss attack. Where the input is reflected onto the page, and executes javascript. To prevent this you have to use innerText, or you can also parse the input text by checking if there is any javascript in the input before showing it into the DOM.
In Jquery, you can use .text() method.
The Javascript part is:
jQuery('#typing_and_press_form').on('submit', function (event) {
event.preventDefault();
if(jQuery('#typing_and_press').val()){
var enteredValue = jQuery('#typing_and_press').val();
spanElem = jQuery('.tagsgroupkeyup').append('<div class="tagstyle"><span></span><span id="' + enteredValue + '" class="remove">X</span></div>');
spanElem.find("span:first").text(enteredValue)
jQuery('#typing_and_press').val('');
jQuery('#typing_and_press').text('');
}
})

javascript get all inputs inside div including select and textarea

I have been trying to figure out how to get all the input elements inside a div including select and textarea and pass them to editor, so far i figured out with input but i am just stuck with the rest.
Here is the code so far
function InsertShortcode(elem) {
var shortcodeName = elem.parentElement.id;
var inputs = document.getElementById(shortcodeName).getElementsByTagName('input'), i=0, e;
var inputs_val = '[' + shortcodeName;
while(e=inputs[i++]){
if(e.id){
inputs_val += ' ' + e.id + '="' + e.value + '"';
}
}
inputs_val += ']';
window.send_to_editor(inputs_val);
}
By this i am able to grab all the inputs inside a div where submit button is but still i am not sure how to grab textarea or select inputs.
The problem is that i have to make it dynamic. I will have many "shortcodes" and each will be in it's own div where the button is. But each will have it's own inputs which i can't control so i need to grab them all and send values to editor. Here's example of the code.
<div class="output-shortcodes">
<?php foreach( $theme_shortcodes as $key => $name ) { ?>
<div id="<?php echo $key ?>">
<p>
<h2><?php echo $name ?></h2>
</p>
<?php $form = $key . '_form';
if(function_exists($form)) {
$form(); // this is where the input fields are dynamically created on each shortcode.
}
?>
<button class="button-primary" onclick="InsertShortcode(this)">Insert shortcode</button>
</div>
<?php } ?>
</div>

Use jQuery and the :input pseudo selector:
$('.output-shortcodes').find(':input');
That simple.
https://api.jquery.com/input-selector/
Or wrap it in a <form>, then you can use:
document.getElementById("outputForm").elements...
https://developer.mozilla.org/en-US/docs/Web/API/HTMLFormElement/elements

You can target your wrapper element and locate thru .find() all inputs within:
var inputs = $("#" + shortcodeName).find("select, textarea, input");

If you can use jQuery here is a fiddle: https://jsfiddle.net/q33hg0ar/
<div id="form">
<input type="text" name="input1" />
<select name="cars">
<option value="volvo">Volvo</option>
<option value="saab">Saab</option>
<option value="mercedes">Mercedes</option>
<option value="audi">Audi</option>
</select>
<textarea name="notes"></textarea>
<button class="button-primary" onclick="InsertShortcode(this)">Insert shortcode</button>
</div>
<script>
$(document).ready(function() {
$('#form').find('input, select, textarea').each(function() {
console.log($(this).attr('name'));
});
});
</script>
And here it is w/o jQuery: https://jsfiddle.net/67pp3ggu/
window.onload = runIt();
function runIt() {
var elements = document.getElementById('form').childNodes;
var inputTypes = ['text', 'select-one', 'textarea'];
for (var i = 0; i < elements.length; i++) {
var elm = elements[i];
if (typeof elm.type !== 'undefined' && inputTypes.indexOf(elm.type)) {
console.log(elm);
console.log(elm.type);
}
}
}

At the end i switched to jQuery code completely and using :input helped me to resolve the problem.
Here is the complete code that i use now.
$('.vivid-framework-submit-shortcode').click(function(event) {
event.preventDefault();
var shortcodeName = $(this).closest('div').attr('id');
var inputs = $('#' + shortcodeName).find(':input');
var inputsVal = '[' + shortcodeName;
inputs.each(function() {
if($(this).attr('id') != 'content') {
inputsVal += ' ' + $(this).attr('id') + '="' + $(this).val() + '"';
console.log(inputsVal);
}
});
inputs.each(function() {
if($(this).attr('id') == 'content' ) {
inputsVal += ']' + $(this).val() + '[/' + shortcodeName;
}
});
inputsVal += ']';
window.send_to_editor(inputsVal);
});
What does it do? So now when i click on a button within shortcode div first using preventDefault to prevent page to scroll to top, next i grab the id of that div using it as shortcode name, and lastly i grab all the inputs and check if one of the inputs have id content because that will decide if shortcode is enclosed or selfclosed and loop through all inputs outputting their id's and values. and at the end return that to the editor.
Some of the terms may be unfamiliar but those who are familiar to WordPress will recognize terms like shortcode...
At the end final output is:
[bartag foo="value" bar="value"]content from textarea[/bartag]
If you downvote my questions or answers please explain why because i always tend to explain or ask as detailed as i can.

Delete row from dynamic table

I have created a table dynamically using Javascript .i am able to add rows but not able to delete.
MyHtml:
<div id="Mutipletextboxhandler" style="text-align: center;" class="step" name="Mutipletextboxhandler">
</div>
<input id="Hidden" type="hidden" runat="server" value="" />
<input id="btnAddexisting" type="button" value="Insert item" onclick="AddmultipleTextBox()" />
And my Javascript:
<script type="text/javascript">
function AddmultipleTextBox() {
var div = document.createElement('DIV');
div.innerHTML = GetDynamicmultipleTextBox("");
document.getElementById("Mutipletextboxhandler").appendChild(div);
}
function GetDynamicmultipleTextBox(value) {
return '<table id="d"><tr><td><input name = "mDynamicTextBox1" type="text" value = "' + value + '" /></td><td><input name = "mDynamicTextBox2" type="text" value = "' + value + '" /></td'+
'<td><input name = "mDynamicTextBox3" type="text" value = "' + value + '" /></td>'+
'<td><input type="button" value="Remove" onclick = "RemovemultipleTextBox(this)" /></td>' +
'</tr></table>'
}
**//Problamatic Function is below:**
function RemovemultipleTextBox(div) {
document.getElementById("Mutipletextboxhandler").removeAttributeNode(div);
}
function RecreateDynamicmultipleTextboxes() {
var mvalues = eval('<%=mValues%>');
if (mvalues != null) {
var html = "";
for (var i = 0; i < mvalues.length; i++) {
html += "<div>" + GetDynamicmultipleTextBox(mvalues[i]) + "</div>";
}
document.getElementById("Mutipletextboxhandler").innerHTML = html;
}
}
window.onload = RecreateDynamicmultipleTextboxes;
</script>
Question-Addition of rows is working fine but when i delete ,then
"NO Such interface supported" Error is coming.
Its working fine if i have no tables and only one texbox.
Somebody please help.

try document.getElementById("Mutipletextboxhandler").removeChild(div)
Update:
you can update your funtion as something like this
function RemovemultipleTextBox(div) {
while((div.tagName != "HTML" || div.tagName != "TABLE") && div.id != "d") {
div = div.parentNode
}
if(div.tagName == "TABLE") {
document.getElementById("Mutipletextboxhandler").removeChild(div.parentNode);
}
}

edit:
Let's redo this with a proper handler.
Step 1: Add a class to your input button and remove the onclick.
<input class="button-remove" type="button" value="Remove" />
Step 2: Add this logic every place you call GetDynamicmultipleTextBox. We create the box into a variable, then select the button out of this box and add an event listener.
var box = GetDynamicmultipleTextBox();
box.querySelector('.button-remove').addEventListener('click', function (event) {
var button = event.target,
div = button.parentNode.parentNode.parentNode.parentNode;
document.getElementById("Mutipletextboxhandler").removeChild(div);
});
Step 3: document.getElementById("Mutipletextboxhandler").appendChild(box);

Renaming form fields added or deleted dynamically

I'm looking for help to rename the name attributes of some fields created dynamically.
Now, my code assigns new values to the added fields (it increments according to the length of the div) but the problem appears when I delete a field, I don't know how to rename the remaining according to the number of fields deleted.
jQuery:
$(document).ready(function () {
$("#add").click(function () {
var intId = $("#reglas div").length;
var fieldWrapper = $('<div></div>', {
class: 'fieldwrapper',
id: 'field' + intId
});
var fPath = $('<input align="left" type="text" placeholder="Path" class="reglas_wrapper" id="path" name="field1_' + intId + '" required /> ');
var fTTL = $('<input type="text" class="reglas_wrapper" placeholder="TTL" id="ttl" name="field2_' + intId + '" required />');
var removeButton = $('<input align="right" type="button" id="del" class="remove" value="-" /> <br><br>');
removeButton.click(function () {
$(this).parent().remove();
});
fieldWrapper.append(fPath);
fieldWrapper.append(fTTL);
fieldWrapper.append(removeButton);
$("#reglas").append(fieldWrapper);
});
$("#cache").each(function () {
$(this).qtip({
content: {
text: $(this).next('.tooltiptext')
}
});
});
});
$('#formsite').on('submit', function (e) {
//prevent the default submithandling
e.preventDefault();
//send the data of 'this' (the matched form) to yourURL
$.post('siteform.php', $(this).serialize());
});
HERE'S MY FULL CODE: http://jsfiddle.net/34rYv/131/

You will want an incrementor. Check out this updated fiddle.
Here is the beginning of the code:
$(document).ready(function() {
var myIncr = 0;
$("#add").click(function() {
myIncr++;
var intId = myIncr;

You can add a class or id to each input field, and then depending on that class or id add the name as
<input type="text" class="something" />
Use this jQuery:
var classval = $('input[type=text]').attr('class'); // get class..
// now add the name as
$(this).attr('name', classval);
You can have as many inputs, they will be added the name depending on their class or id!
So even if the input fields are deleted, you will still have the class attributes in the control!

jquery incrementing number in html name=""

I want the variable inputname to go up by 1 every time a new <input /> is added
e.g.
<input name="1" />
<input name="2" />
<input name="3" />
---html---
<p class="add">Add</p>
<div class="added"></div>
---jQuery/javascript---
$(document).ready(function() {
$("p.add").click(function() {
var inputname = somevar;
var added = "<input type=\"text\" name=\""+inputname+"\" />";
$("div.added").append(added);
});
});
here it is on jsfiddle.net if it helps -> http://jsfiddle.net/gamepreneur/54kzw/

Set inputname like this:
var inputname = $('.added input').length + 1;
This gets the total number of added inputs and increments by one, resulting in the new name.

Change the variable scope
Use this:
// declare your variable here so it exists throughout every call, instead of being
// delcared new with every call.
var inputname = somevar;
$(document).ready(function() {
$("p.add").click(function() {
var added = "<input type=\"text\" name=\""+(inputname++)+"\" />";
$("div.added").append(added);
});
});
Alternatives:
Grab the number of inputs ($('div.added input').length) and use that for a counter.
Grab the id of the last item $('div.added input:last').prop('name')) and increment it.

You need to declare inputname in the global scope so that it lasts longer than just the duration of the click function and then you need to increment it each time you use it.
I modified your fiddle to this: http://jsfiddle.net/jfriend00/54kzw/2/
var inputname = 1;
$(document).ready(function() {
$("p.add").click(function() {
var added = "<input type='text' name='" + inputname++ + "' />";
$("div.added").append(added);
});
});

Try
$(document).ready(function() {
$("p.add").click(function() {
var inputname = $('input', $("div.added")).length + 1;
var added = "<input type=\"text\" name=\"" + inputname + "\" />";
$("div.added").append(added);
});
});
Consider adding some other selectors to choose those inputs (like a class selector)