Comments on: Why do escape characters disappear?

Why do escape characters disappear?

scarabic — Tue, 17 Oct 2006 01:07:53 -0800

Simple html escape characters appear to work in the live preview but don't come through correctly. Is this a bug or intentional?

By: scarabic

scarabic — Tue, 17 Oct 2006 01:08:19 -0800

169;

That's supposed to be a copyright symbol. Looks like one in live preview...

By: scarabic

scarabic — Tue, 17 Oct 2006 01:08:51 -0800

Unfortunately, it's a "169;" after posting.

By: Aidan Kehoe

Aidan Kehoe — Tue, 17 Oct 2006 01:20:28 -0800

© is Ampersand-hash mark [number sign]-digit one-digit six-digit nine-semicolon and appears as such in live preview.

It appears as digit one-digit six-digit nine in real preview, but as a copyright sign in the text-entry box. I'm about to hit Post Comment; I suspect it will come through.

By: The God Complex

The God Complex — Tue, 17 Oct 2006 01:25:59 -0800

Just use ascii like me!

© = alt-0169
® = alt-0174
™ = alt-0153

By: scarabic

scarabic — Tue, 17 Oct 2006 01:26:12 -0800

169;

I thought that's what I entered. Let's try this again.

By: Aidan Kehoe

Aidan Kehoe — Tue, 17 Oct 2006 01:26:54 -0800

Oops, I meant the first sequence of characters appeared as a copyright symbol in live preview.

And it did. Matt's being inconsistent; he either needs to accept HTML entities, or not. "Not" would involve the equivalent of htmlspecialchars() on the text to be displayed in the text entry box after "Preview" has been hit. Mixing the two is a UI nightmare.

(南 is the Han character for "south, southwards" and I didn't enter it as a HTML entity, rather I pasted it from another application. I wonder will it make it through; Firefox will send it as UTF-8, the encoding of the page, so the only thing that could fuck it up would be Cold Fusion.)

By: scarabic

scarabic — Tue, 17 Oct 2006 01:28:31 -0800

Okay, I tried:

Ampersand-hash mark [number sign]-digit one-digit six-digit nine-semicolon

I'm not sure what's meant by "alt-0169" but typing those keystrokes didn't seem to help.

I'm a moron and I can admit it. Hope me.

By: Aidan Kehoe

Aidan Kehoe — Tue, 17 Oct 2006 01:29:11 -0800

TGC, neither the copyright symbol, the registered trade mark sign, nor the non-registered trade mark sign are in ASCII. You're entering their Windows 1252 values.

By: Aidan Kehoe

Aidan Kehoe — Tue, 17 Oct 2006 01:34:07 -0800

Scarabic, it's five keystrokes. Hold down Alt, enter 0 1 6 9 on the numeric keypad, release Alt. This won't work if you're on a Mac, though--in that case, I believe ⌘ - r will give you the ® sign, ⌘ - 2 the ™ sign, and ⌘ - g the © sign, but I don't have one to hand to confirm that.

By: Aidan Kehoe

Aidan Kehoe — Tue, 17 Oct 2006 01:37:21 -0800

On further del.icio.us'ing, here's how you generate various European-language typographical symbols on a Mac.

By: The God Complex

The God Complex — Tue, 17 Oct 2006 01:42:01 -0800

TGC, neither the copyright symbol, the registered trade mark sign, nor the non-registered trade mark sign are in ASCII. You're entering their Windows 1252 values.

Interesting. I only call them ascii because that's what all the cool kids called them when we were Win-nuking people to blue screens while playing the first Diablo some decade ago. Oh, the days.

By: scarabic

scarabic — Tue, 17 Oct 2006 01:45:50 -0800

○

Aidan Kehoe is my hero

By: scarabic

scarabic — Tue, 17 Oct 2006 01:46:25 -0800

Aidan Kehoe is ~~my hero~~ fucking with me.

By: Aidan Kehoe

Aidan Kehoe — Tue, 17 Oct 2006 01:57:12 -0800

Heh. Matt's fuсking with you (a fucking-with of omission, rather than of comission, if you can imagine such a thing); that's what I meant above by 'mixing the two is a UI nightmare.'

© is what I get when I type Alt 0 1 6 9 , click Preview, and then click Post Comment. I can only enter your funky white circle by pasting from another app.

By: scarabic

scarabic — Tue, 17 Oct 2006 02:10:03 -0800

○

By: scarabic

scarabic — Tue, 17 Oct 2006 02:12:35 -0800

I know you're not trying to lead me astry, Aidan :)

It's weird. I keep getting this little anemic-looking circle when I type in that code. Could just be my computer, although it's a pretty standard install of XP Pro.

I don't see why I can't type in basic html escape characters, though. Do they represent some security risk which other html does not?

By: matthewr

matthewr — Tue, 17 Oct 2006 02:29:33 -0800

I don't see why I can't type in basic html escape characters, though.

Type — to get '—' or · to get '·'. Don't click Preview; just click Post. The semi-colon at the end is unnecessary in Live Preview, but needed when you post.

By: davehat

davehat — Tue, 17 Oct 2006 02:31:39 -0800

& copy ; (no spaces) gives ©

Taz and I helped someone else out with this a while ago who was struggling with em dashes. mathowie popped in to the thread and stated:

entity encoding was removed when someone showed me some really easy hacks you could use it to do. It was possible to entity encode all sorts of nasty remote scripting stuff.

If you want an emdash, just copy and paste the character in or do the ampersand-mdash-semicolon, don't use the character entity.

By: bouncebounce

bouncebounce — Tue, 17 Oct 2006 03:05:03 -0800

The thing is, I managed to get a pound sterling symbol (£) in a recent MeTa post using HTML entities.

By: bouncebounce

bouncebounce — Tue, 17 Oct 2006 03:06:25 -0800

So it doesn't work with decimal entities, just the named ones? What about hex values? (xA9;)

By: MetaMonkey

MetaMonkey — Tue, 17 Oct 2006 03:45:17 -0800

Seems like there's a MeTa thread about this weekly, this formatting business needs an FAQ of its own, or maybe something in the wiki from whoever has a good handle on all this stuff.

By: Khalad

Khalad — Tue, 17 Oct 2006 05:08:29 -0800

Without clicking preview:
© produces ©
&169; produces 169;
xA9; produces xA9;

After clicking preview:
© produces ©
&169; produces ©
xA9; produces ©

By: Khalad

Khalad — Tue, 17 Oct 2006 05:12:09 -0800

Interesting. There are some bizarre overzealous entity-destroying rules in place. My correctly-escaped entities before the word "produces" didn't survive even though I wrote out & in full.

By: cortex

cortex — Tue, 17 Oct 2006 06:15:16 -0800

blah blah blah our new bizarre overzealous entity-destroying overlords &c

By: terrapin

terrapin — Tue, 17 Oct 2006 07:44:01 -0800

This gets asked often enough to be a FAQ entry, methinks.

By: mathowie

mathowie — Tue, 17 Oct 2006 09:04:34 -0800

I block all instances of ampersand-poundsign and hex values because someone showed me quite effectively how you could encode nasty XSS javascript using entities and get it to pass into MeFi and do things like send your password cookies to remote servers and whatnot.

I decided to block numbered entities because there is usually an equivalent (ampersand-copy, instead of ampersand-169, etc) that more people use (and can remember).

For security reasons, entities aren't coming back.

By: jessamyn

jessamyn — Tue, 17 Oct 2006 12:03:04 -0800

I added that to the FAQ.

By: quin

quin — Tue, 17 Oct 2006 13:00:52 -0800

By: willnot

willnot — Tue, 17 Oct 2006 13:31:30 -0800

® = & reg ; (without the spaces)

By: quin

quin — Tue, 17 Oct 2006 14:53:15 -0800

Thanks willnot.

By: scarabic

scarabic — Tue, 17 Oct 2006 18:08:54 -0800

you could encode nasty XSS javascript using entities and get it to pass into MeFi and do things like send your password cookies to remote servers

Keee-rist! Scary!

® ©

By: scarabic

scarabic — Tue, 17 Oct 2006 18:08:59 -0800

yay!

By: MetaMonkey

MetaMonkey — Wed, 18 Oct 2006 02:39:44 -0800

By: plinth

plinth — Wed, 18 Oct 2006 07:31:49 -0800

By the way, in order to get © to appear (as opposed to typing & copy; you need to type &copy;). Hitting preview breaks this as it removes the escaping for ampersand, so it needs to be redone after preview (or you can copy the text from the comment box before preview, paste it back in post preview than hit post if everything is copacetic).