vedmack / yadcf

Yet Another DataTables Column Filter (yadcf)
http://yadcf-showcase.appspot.com/
MIT License
731 stars 285 forks source link

Properly support values with special characters #637

Closed m417z closed 4 years ago

m417z commented 4 years ago

Adds support for values like: A"B'C&nbsp;<script>alert(1)</script>.

This is similar to this commit which was reverted: https://github.com/vedmack/yadcf/pull/630/commits/a88cd9bf6206c8bac53e72bb1cd3e56a23e781ee

vedmack commented 4 years ago

but using .text() is different than .val() it will give different result , for example in this <option value="1">test1</option> it will return test1 instead of 1

m417z commented 4 years ago

They had the same value, but text worked, while val escaped the " symbol. Looking at the code, I saw that you escaped the symbol explicitly, something that is no longer necessary, so I changed the PR to remove the escaping instead.

vedmack commented 4 years ago

@m417z why is the escaped the symbol explicitly is no longer necessary?

m417z commented 4 years ago

Because it's passed to jQuery which does all of the necessary escaping.

louking commented 4 years ago

but using .text() is different than .val() it will give different result , for example in this <option value="1">test1</option> it will return test1 instead of 1

Sorry to jump in, but what happened about this comment? If value is different than text, shouldn't .val() be used? (I'll confess I haven't looked at the commit/code)

m417z commented 4 years ago

They're not different in this particular case, but regardless, I left the code to keep using val. That's what I meant here:

I changed the PR to remove the escaping instead.

(instead of changing val to text)