HTML Output Demo — Basic Web Form

NOTE: Web Browsers And Cross-Site Scripting

All demos in this section use web forms to submit INTEGRAL DSL code for processing to our web server. At the same time, most modern web browsers (e.g. Safari, Chrome, Internet Explorer) employ various algorithms and/or heuristics to filter out potentially dangerous HTML code that is submitted via web forms. This is done to protect web applications and users from so called cross-site_scripting attacks. Even though these algorithms and heuristics are imperfect, in most use-case scenarios they do more good than bad. However, in this specific case they sometimes interfere with the proper functioning of the demos, which is not so good!

As an example, in the following line of the Basic Web Form demo code:

p("<form method=\"get\" action=\"form_get.i\">\n");

Safari and Chrome will see the action keyword and assume it's part of a potentially dangerous HTML payload. Therefore, on form submission, they will filter out the value of the action keyword, effectively corrupting the code. Obviously this makes the form demo non-functional. To circumvent this, the above line is rewritten as follows:

p("<form method=\"get\" acti" + "on=\"form_get.i\">\n");

This slightly modified line of INTEGRAL DSL code generates exactly the same result on the server, yet it evades both browsers since they can no longer see the action keyword. This actually shows how ineffective their filtering techniques would be if this was a truly dangerous payload.

In any case, there are other situations when different web browsers might interfere with INTEGRAL DSL code that you input via these forms. You may have to modify your code in various ways to circumvent this. Regardless of this, please note the issue is not caused by this website or the INTEGRAL web server but your own browser. It only affects code that is submitted via web forms.

Close