Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

best way to inject html using javascript

Tags:

javascript

I'm hoping that this isn't too subjective. I feel there is a definitive answer so here goes.

I want to create this html on the fly using JS (no libraries):

<a href="#" id="playButton">Play</a> <a href="javascript: void(0)" id="muteUnmute">Mute</a> <div id="progressBarOuter">    <div id="bytesLoaded"></div>     <div id="progressBar"></div> </div> <div id="currentTime">0:00</div> <div id="totalTime">0:00</div> 

using javascript. I know I can do this using createElement etc but it seems extremely long winded to do this for each element. Can anyone suggest a way to do this with more brevity.

I do not have access to a library in this project....so no jquery etc.

like image 664
Mike Rifgin Avatar asked Sep 21 '10 16:09

Mike Rifgin


People also ask

How is HTML injection performed?

Example Of Html Injection Then the attacker sends the URL with malicious code injected in the URL to the victim user either through email or some other mechanism. If the victim user click this malicious URL, it will run the JavaScript or VBScript code with the privileges of the victim user.

Is HTML embed safe?

You can securely embed content onto any website, using the existing iframe specification. More HTML elements, including <fencedframe> and <portal> have been proposed for security and style improvements.


2 Answers

Keep your markup separate from your code:

You can embed the HTML snippets that you'll be using as hidden templates inside your HTML page and clone them on demand:

<style type="text/css"> #templates { display: none } </style> ... <script type="text/javascript"> var node = document.getElementById("tmp_audio").cloneNode(true); node.id = ""; // Don't forget :) // modify node contents with DOM manipulation container.appendChild(node); </script> ... <div id="templates">     <div id="tmp_audio">         <a href="#" class="playButton">Play</a>         <a href="#" class="muteUnmute">Mute</a>         <div class="progressBarOuter">              <div class="bytesLoaded"></div>             <div class="progressBar"></div>         </div>         <div class="currentTime">0:00</div>         <div class="totalTime">0:00</div>     </div> </div> 

Update: Note that I've converted the id attributes in the template to class attributes. This is to avoid having multiple elements on your page with the same ids. You probably don't even need the classes. You can access elements with:

node.getElementsByTagName("div")[4].innerHTML =     format(data.currentTime); 

Alternatively, you can act on the HTML of the template:

<script type="text/javascript"> var tmp = document.getElementById("tmp_audio").innerHTML; // modify template HTML with token replacement container.innerHTML += tmp; </script> 
like image 105
Ates Goral Avatar answered Sep 17 '22 21:09

Ates Goral


Shove the entire thing into a JS variable:

var html = '<a href="#" id="playButton">Play</a>'; html += '<a href="javascript: void(0)" id="muteUnmute">Mute</a>'; html += '<div id="progressBarOuter"><div id="bytesLoaded"></div><div id="progressBar"></div></div>'; html += '<div id="currentTime">0:00</div>'; html += '<div id="totalTime">0:00</div>'; 

Then:

document.getElementById("parentElement").innerHTML = html; 

if you want theN:

document.getElementById("totalTime").innerHTML = "5:00"; 
like image 42
Ryan Ternier Avatar answered Sep 20 '22 21:09

Ryan Ternier