Encode the URL in the "src" attribute

  • Resolved cpag

    (@cpag)


    10 years, 3 months ago

    <iframe id='1' class='StefanoAI-youtube-responsive ' width='160' height='90' src='//www.youtube.com/embed/XXX?&autohide=2&color=red&controls=1&disablekb=0&fs=1&iv_load_policy=1&loop=0&modestbranding=0&rel=0&theme=dark' frameborder='0' allowfullscreen="true" style=''></iframe>

    Please escape the URL: & => & amp;

    Line 73, add:
    $urlEsc = esc_attr("$url$idvideo?$autohide$autoplay$cc_load$cc_lang$color$controls$disablekb$end$fs$iv_load_policy$loop$modestbranding$rel$showinfo$start$theme$quality");

    Then in line 79, use: src='$urlEsc'

    https://www.ads-software.com/plugins/youtube-widget-responsive/

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author stefanoai

    (@stefanoai)

    Currently the manual youtube uses only “&”, although & amp; work, I prefer to keep the rules laid down by Google.
    However, in the next version will insert a filter, so you will be able to escape parameters using a filter in functions.php

    Thread Starter cpag

    (@cpag)

    Here is the documentation : https://developers.google.com/youtube/iframe_api_reference#Loading_a_Video_Player .

    They just forgot to escape. All HTML attributes must be escaped, the right way is the standard from W3C. Try to validate a page with your plugin : https://validator.w3.org/ . Your plugin makes invalid Web pages.

    Plugin Author stefanoai

    (@stefanoai)

    Added option w3c on widget and shortcode in the v0.6

    Thread Starter cpag

    (@cpag)

    Thanks.

    But you know, after the HTML code is parsed by the browser, all invalid “&” are fixed and the JavaScript code from Youtube can’t see any difference. This option shouldn’t be an option. Really, it is just a best practice to respect the standard.

    For example, this code displays the same URL twice:

    <!doctype html>
<html><body>
<iframe id="player1" type="text/html" width="640" height="390"
  src="https://www.youtube.com/embed/M7lc1UVf-VE?enablejsapi=1&origin=https://example.com"
  frameborder="0"></iframe>
<iframe id="player2" type="text/html" width="640" height="390"
  src="https://www.youtube.com/embed/M7lc1UVf-VE?enablejsapi=1& amp;origin=https://example.com"
  frameborder="0"></iframe>
<script>
var p1 = document.getElementById('player1');
var p2 = document.getElementById('player2');
alert(p1.getAttribute('src') + "\n\n" + p2.getAttribute('src'));
</script>

    But OK thank you for the option.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Encode the URL in the "src" attribute’ is closed to new replies.