POSTing XML via HTML Forms

Question

I am developing a web and want to make it so that the user can create some stuff POSTing XML data. For that purpose there is a <textarea> where the user can write (copy/paste) XML and submit it. The problem is that I am losing data: characters such as <, >, and I think others too, get lost.

Maybe it is a framework problem, not sure, I am using Elgg and receiving the data with get_input().

UPDATE1: some code answering the comment:

<form method="POST" action="http://for.bar/slash" enctype="text/xml">
<input name="add" type="submit" value="Create"  />
</form>

to receive the data I use elgg get_input()

$data = get_input('data');

According to this answer to the question How to post XML to server thru HTML form?, text/xml is not a permitted value for the enctype attribute. — DavidRR
– DavidRR, Commented May 27, 2014 at 0:36

rook · Accepted Answer · 2010-02-24 23:30:28Z

1

If i where to make a wild guess I'd say that there is some kind of auto-magical xss protection being used by get_input(). You could try doing a print_r($_POST); or perhaps elgg is "sanitizing" all of $_POST as well. In this case you may have to base64 encode the data with JavaScript before submitting the request.

answered Feb 24, 2010 at 23:30

rook

67.1k38 gold badges171 silver badges248 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

conradsteink Over a year ago

You was right! Thx a lot. The get_input() function has a $filter_result = true parameter.

bobince Over a year ago

+1. Yeah, this results in the input being manged by htmlawed_filter_tags, which tries to make the input HTML whether it was supposed to be HTML or not. XSS “protection” at the input stage is always the wrong thing, and this is a particularly bad example of it. I strongly question the competence of the developers of this package.

rook Over a year ago

That is a nasty "feature" that is all too common. I agree that it is the wrong place for an xss filter. I am glad I can help!

Fusion · Accepted Answer · 2021-09-25 20:07:56Z

0

According to MDN, the only standard values that should be used in form's enctype attribute are following:

application/x-www-form-urlencoded
multipart/form-data
text/plain

That being said, you can run into unpredictable situations having it to have value application/xml.

Source: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/form#attr-enctype

answered Sep 25, 2021 at 20:07

Fusion

5,5926 gold badges47 silver badges55 bronze badges

Collectives™ on Stack Overflow

POSTing XML via HTML Forms

2 Answers 2

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related