Escaping RedDot

Note: This post also appears on the Unofficial RedDot CMS Blog - check it out for more RedDot related posts from RedDot developers across the globe and less of my personal stuff :)  More importantly - why not get even more out of it by suggesting a topic for post of the month?

In today’s episode, we will cover:

  • How to safely(ish) use the output of content elements in scripts within our RedDot templates.
  • How not to use the output of content elements in scripts within our RedDot templates.
  • Reinforce that Preview is not the same as Publish!

Nothing like a little frustration to spur a new blog post. It all began last week as I was adding some localisation to a RedDot 6.5 project. Everything was working beautifully in SmartEdit and Preview. Then I published and it all went so very wrong…

By wrong I mean there was an error in the pre-execute code. Ie on the published page, anything within pre-execute tags was blank, missing, gone. But preview worked! And preview and publish are the same, right?

Using a slow process of elimination (anyone know where the publish pre-execute temporary files are kept?) I eventually discovered the issue. Sadly, it was one that had bitten me before - and hence will be immortalised here so that you and I should not fall prey to it again. But first, some background…

Every now and then (okay, all of the time) I find the need to take the content of a placeholder and either use it elsewhere (outside of the template it is defined in) or manipulate it in some way. Part of (okay, all of) the charm of RedDot’s templating system is that you have a whole scripting engine at your disposal - ASP (VBScript and JScript) or you can setup PHP (or even ASPX I believe…) Assigning a placeholder to a variable is a piece of cake:

VBScript:

<!IoRangePreExecute>
<%
myVar = "<%myPlaceholder%>"
%>
<!/IoRangePreExecute>

PHP:

<!IoRangePreExecute>
<?php
$myVar = '<%myPlaceholder%>';
?>
<!/IoRangePreExecute>

Or is it? What happens when the content of myPlaceholder contains double quotation marks? Or worse, if you are using PHP, a dollar sign or an apostrophe? (depending on which form of assignment you are using) Unfortunately, RedDot doesn’t allow you to specify the escaping of placeholders, so here are a few tricks all RedDot developers should know:

VBScript: For this we rely on the fact we get JScript for free…

<!IoRangePreExecute>
<script language="jscript" runat="server">
function myPlaceholder() { /*<%myPlaceholder%>*/ }

function getVar(id) {
   var re = /\/\*(.*)\*\//;
   return re.exec(eval(id + ".toString()"))[1];
}
</script>
<%
myVar = getVar("myPlaceholder")
%>
<!/IoRangePreExecute>

Or, much more simply in PHP:

<!IoRangePreExecute>
<?php
$myVar = <<<EOD
<%myPlaceholder%>
EOD;
?>
<!/IoRangePreExecute>

If you don’t need to manipulate the value, ie you want to output it later or based on some criteria or even output a chunk of HTML and/or placeholders, you can surround it with a function or subroutine:

VBScript (won’t be broken by */ or anything else in the content):

<!IoRangePreExecute>
<%
Sub header()
%>
<div id="header"><h1><%myPlaceholder%></h1></div>
<%
End Sub
header()
%>
<!/IoRangePreExecute>

PHP (won’t be broken by EOD; or anything else in the content - or whatever you used with the <<< operator):

<!IoRangePreExecute>
<?php
function header() {
?>
<div id="header"><h1><%myPlaceholder%></h1></div>
<?php
}
header();
?>
<!/IoRangePreExecute>

I find the above particularly good for reducing the number of container placeholders in my base pages (to one - but that is another post). You can also do some neat tricks with the red dots themselves - but again, another post.

Ok - now for the caveat. When doing variable assignment above, using the VBScript/JScript method, you can’t use any form of string manipulation on variables containing links to RedDot assets. Specifically, you can’t perform any of the following actions:

  • Regular expression matching (ie our JScript example)
  • Any VBScript string function - InStr, Mid, Replace, Split etc

On any variable that contains any of the following placeholders:

  • Anchors (whether to RedDot pages or external URLs)
  • Images
  • Media
  • Text - where the text may contain any of the above.

The most annoying thing is that it will work in Preview, lulling you into a false sense of security. That last one (Text placeholders) was one that had caught me out before - because the Publish suddenly stopped working for no apparent reason (it was fine with all the samples prior to that that did not contain links or images…)

This time around, it was anchor and image placeholders that I had used in the JScript functions - once I removed these (I replaced them with the subroutine method - as I didn’t actually need to manipulate them) everything was fine again.

If you must manipulate dodgy placeholders, you have a couple of options:

  • Switch to PHP - the issue only seems to affect ASP (VBScript/JScript). I can’t speak for ASPX.
  • Perform your manipulations on the web server (save as .asp or any other scripting language you like - once it is on the web server, it is free of RedDot issues - well unless you are using LiveServer of course!)

Here endeth the lesson.

3 Responses to “Escaping RedDot”

  1. Simon Lewis Says:

    Great article; thanks. I too have suffered with the problem of loading placeholder values into ASP variables when the placeholder contains a double quote character. The solution given to me was to use a render tag, like this:

    var = “<%!! Escape:HtmlEncode(Context:CurrentPage.Elements.GetElement(txt_body).Value) !!%>”

    This ensures that any dodgy characters are escaped *before* being assigned to the ASP variable. Works a treat.

  2. Adrian Says:

    I am currently working in RedDot CMS 6.5 - so unfortunately render tags are not an option. I currently do not have access to RedDot CMS 7.5, so I assume the Escape:HtmlEncode replaces double quotes with the equivalent HTML character entity. What happens when your txt_body contains an image or URL? Does it replace newlines as well - and if so, with what? My vague recollection of using the Escape:HtmlEncode (though it was for Navigation Manager, not escaping for use with VBScript) was that it solved some issues, but not all - and the ones it didn’t solve were the ones that bit you later…

    Even assuming the Escape:HtmlEncode works perfectly in all cases, the real issue is that it is HTML escaping, not VBScript escaping - and the requirements are not exactly the same. If they work, great - but consider it luck, not by design - and take appropriate caution!

  3. Adrian Mateljan » Blog Archive » Open Text UK Web Solutions Community Day 2009 Review Says:

    [...] nature of the session, there are a number of issues not touched upon in the code samples, including placeholder escaping and code efficiency (one, you will probably want to use functions, two beware large amounts of [...]

Leave a Reply