eventhandling in innerHTML string not parsed in IE sp2

[Nebse]

Hello everybody

I'm pusseled here ... I wrote code for dynamically building the layout of a page (celle/rows) ... these cells are divs nested inside each other... AND: when clicking one of the cells on the page - my script pops up a div containing buttons and input boxes for setting the size,color,padding etc. of the div you clicked.. now: the whole content of the pop-up-div is written in a string and set by "popupdiv.innerHTML += contentstring" ... my problem is now that the eventhandlers on the buttons are not parsed ... they dont fire/handle events!! - that is not in IE sp2 anyway! ... the script has worked fine on IE 6 (standard) for several months ... does anybody know a workaround or do I have the rewrite the script declaring the eventhandlers programmatically??!!

codesnipped:
str += "</table>";
str += "<input type=\"submit\" value=\"Opdater\" onclick=\"alter();\"> ";

str += "<input type=\"submit\" value=\"Ny " +labels[callerContent]+ "\" onclick=\"showAddRowOrCol("+callerContent+","+caller.id+");\"> ";
if(wpt != 3)
str += "<input type=\"submit\" value=\"Slet\" onclick=\"if(confirm('Are you sure you want to delete "+wpttext+" !?')){deleteDiv("+caller.id+");}\">";

var theDiv = document.createElement("DIV");
theDiv.id = "divForPropertyAltering";
theDiv.style.cssText = "visibility:hidden;padding:15px;color: Black;display: block;position: absolute;left: "+left+";top: "+top+";background-color: gray;border: black 3px solid;color: black;";
theDiv.style.filter = theFilter;
theDiv.innerHTML = str;
//alert(theDiv.innerHTML);//theDiv.onclick = test;
return theDiv;

I have tested tat I can add eventhandler via code if I don't use innerHTML but use "theDiv.onclick = test;" as you can se... DAMN but it used to work! (and it is so much easier) ...

Can it be a security issue?? or does IE sp2 just not parse innerHTML proporly??

please help!! .. MS and their "enhancements" are a pain in the "arse" ...

 

[BillyRayPreachersSon]

Have you tried:

1. Making the button type "button" instead of "submit"
2. Setting the style properties of the DIV individually using ".style." instead of collectively using ".cssText"

Incidentally, ".innerHTML" is, AFAIK, not part of any standard, so expecting browsers to continue supporting non-standard interfaces is fruitless. I'd "upgrade" your code to use more standard, and widely supported (albeit "long-hand") methods.

Hope this helps,
Dan

 

[Nebse]

Thanks for the reply BillyRayPreacherSon... but I found that it was really not a matter of IE not parsing the innerHTML-string, but that IE actually for security reason doesn't see the dynamically created div as being from/a part of the same website ....

If I give "about:blank" status as a trusted website the javascript in the div is allowed to execute ... this presents another problem though ... I have heard mention of an "about:blank"-virus ... and I'm not keen on opening that security hole ... so if anybody knows how to set the domain/website of the new div to something else ... if it can be done at all... I have my doubts since it would not be hard to incorporate this code into a virus ... but if anybody knows anything! - don't hessitate to write! - my client would be very pleased! (And me to )