<pre> tag automatically added - HTMLCodeFormat() and HTMLEditFormat()

Question

I have a form with several TinyMCE textareas. Content is loaded in some textareas when the form is called. Other textareas are empty.

The content that is preloaded into the text fields already has a <p> tag. Everything is fine with it. But i have a problem with the empty textareas. TinyMCE automatically adds a <pre> tag, which destroys the formatting and layout.

This is the process that leads to the problem:

1. Open the form and enter unformatted text to a empty textarea.
2. Save the form. The content is displayed correctly. Everything is fine so far.
3. Edit the form / content.

At this point, TinyMCE adds the pre tag. The tag is not yet saved in the database, it comes from the editor.

I also made some tests with preloaded content. This is the result.

Template code | TinyMCE textarea

<p>test</p> | <p>test</p>
test | <pre>test</pre>

How can I prevent TinyMCE from adding the <pre> tag? Alternatively, <pre> could also be replaced by <p>.

Answer 1

如果您使用的是ColdFusion 10或更高版本，则应使用OWASP ESAPI编码功能。它们处理的字符编码范围高于HTMLEditFormat()和HTMLCodeFormat()。

HTML标记之间的输出：<td>#encodeForHTML(variables.myVar)#</td>

HTML属性中的输出：<input type="text" value="#encodeForHtmlAttribute(variables.myVar)#">

Answer 2

问题的原因是在将内容交给TinyMCE之前使用HTMLCodeFormat而不是HTMLEditFormat。两者都具有几乎相同的效果，但HTMLCodeFormat另外添加了<pre>标记。

HTMLCodeFormat()

HTMLEditFormat()