Note, the result of the AJAX call I've set as HTML. This gives you a chance to check the HTML which has been posted for any malicious script on the server side; allowing someone to enter a <script /> tag straight into the DOM of your page is NOT a good idea.
$(function() {
var editor = CKEDITOR.editor.replace('CKEditor'); // define CKEditor
$("#submit").click(function() {
var text = editor.getData(); // Use CKEditor inbuilt functionality to get the content
$.ajax({
type: "POST",
url: "myscript.aspx",
data: "text=" + text,
dataType: "html",
success: function(data) {
$("#text-container").append(data);
});
});
});
});
发布评论
评论(1)
试试这个:
HTML
jQuery
注意,AJAX 调用的结果我已设置为 HTML。这使您有机会检查服务器端已发布的 HTML 是否存在恶意脚本;允许某人直接在页面的 DOM 中输入
标记并不是一个好主意。
Try this:
HTML
jQuery
Note, the result of the AJAX call I've set as HTML. This gives you a chance to check the HTML which has been posted for any malicious script on the server side; allowing someone to enter a
<script />
tag straight into the DOM of your page is NOT a good idea.