URGENT help

[archit]

Description: You are not allowed to access the document

http://www.vikul.com/<script>alert()</script>&quot;

I need to display the full string in an HTML page but the script tags make the script to get executed.


The dispaly should be

Description: You are not allowed to access the document

http://www.vikul.com/<script>alert()</script>&quot;

and not

Description: You are not allowed to access the document

http://www.vikul.com

with a pop up

 

[mwolf00]

Take the spaces out of the BOLD

You are not allowed to access the document

http://www.vikul.com/

& l t ;script& g t ;alert()

Programming today is a race between software engineers striving to build better and bigger idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. - Rich Cook

 

[archit]

Thanks for the info . But there is a small problem.

Description: You are not allowed to access the document &quot;

http://www.vikul.com/<script>alert()</script>&quot;

In this &quot;

http://www.vikul.com/<script>alert()</script>&quot;

comes from a variable and I have no control over that I simply query that variabe and put it in this HTML page. Is there a way of printing the variable w/o the script getting run ??

Any sort of help will be welcome.

Thanks in advance.
Vikul

 

[TheConeHead]

create a little function that would parse the variable and search for < and > and then substitute them with & g t ; and & l t ;

something like:

function parseMe() {
holder = vAriable;
holderSub2=&quot;&quot;;
for (i=0; i<holder.length; i++) {
holderSub1=holder.substring(i,i+1);
if (holderSub1 == &quot;<&quot {
holderSub1=&quot;& l t ;&quot;
}
if (holderSub1 == &quot;>&quot {
holderSub1=&quot;& g t ;&quot;
}
holderSub2=holderSub2+holderSub1;
}
}

may need fine tuned, but....