将换行符/回车符作为隐藏字段值发布
我需要通过隐藏字段发布多行数据。 发布后数据将在文本区域中查看。 如何在 html 表单中发布换行符/回车符？
我已经尝试过 \r\n 但这只是发布实际的“\r\n”数据
<input type="hidden" name="multiline_data" value="line one\r\nline two" />
有没有办法做到这一点？
I need to post multi-line data via a hidden field. The data will be viewed in a textarea after post. How can I post a newline/carriage return in the html form?
I've tried \r\n but that just posts the actual "\r\n" data
<input type="hidden" name="multiline_data" value="line one\r\nline two" />
Is there a way to do this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
虽然新行（回车和换行）在技术上允许在 的隐藏状态下使用，但为了与旧版浏览器兼容，应该对它们进行转义。 您可以通过替换所有回车符（
\u000D或\r）和所有换行符（\u000A或\n），其中包含被应用程序识别为回车符或换行符的专有字符串（如果存在于原始字符串中，也会进行转义）。示例
例如，在 PHP 中，如果您要将传递的值
回显到文本区域，则需要包含换行符（和未转义的字符串）。但是，在 PHP 中，如果您要将值
回显到 的 value 属性， 标记时，您可以使用专有字符串（例如\r和\n）转义新行，并转义提交值中专有字符串的任何实例。然后，在其他地方使用该值之前（插入数据库、发送电子邮件等），如有必要，请务必对提交的值进行转义。
再次保证
为了进一步保证，我询问了 WHATWG，目前 HTML 规范的编辑 Ian Hickson 回答道：
While new lines (Carriage Return & Line Feed) are technically allowed in <input>'s hidden state, they should be escaped for compatibility with older browsers. You can do this by replacing all Carriage Returns (
\u000Dor\r) and all Line Feeds (\u000Aor\n) with proprietary strings that are recognized by your application to be a Carriage Return or New Line (and also escaped, if present in the original string).Example
For example, in PHP, if you were to
echothe passed value to a textarea, you would include the newlines (and unescaped string).However, in PHP, if you were to
echothe value to the value attribute of an <input> tag, you would escape the new lines with your proprietary strings (e.g.\rand\n), and escape any instances of your proprietary strings in the submitted value.Then, before using the value elsewhere (inserting into a database, emailing, etc), be sure to unescape the submitted value, if necessary.
Reassurance
As further reassurance, I asked the WHATWG, and Ian Hickson, editor of the HTML spec currently, replied:
确实取决于字符集，但是 应该换行并且 应该是回车。 您应该能够在 value 属性中使用它们。
Depends on the character set really but should be linefeed and should be carriage return. You should be able to use those in the value attribute.
您没有说明这是做什么的，也没有说明您正在使用什么技术，但您需要注意，您不能相信隐藏字段会保留 value="line one
第二行”，因为恶意用户可以在 POST 发回之前对其进行篡改。由于您稍后将值放入
值写入隐藏字段并读回时，通常最好将其作为会话的属性保留在服务器上。 ，或页面流，或您的环境提供的任何执行此类操作的内容。
You don't say what this is for or what technology you're using, but you need to be aware that you can't trust the hidden field to remain with value="line one line two", because a hostile user can tamper with it before it gets sent back in the POST. Since you're putting the value in a <textarea> later, you will definitely be subject to, for example, cross site scripting attacks unless you verify and/or sanitize your "multiline_data" field contents before you write it back out.
When writing a value into a hidden field and reading it back, it's usually better to just keep it on the server, as an attribute of the session, or pageflow, or whatever your environment provides to do this kind of thing.
而不是使用
尝试使用
Instead of using
<input type="hidden">Try using
<textarea style="visibility:hidden;position:absolute;">