Hyperlink Control

[Guest]

Hello,

Can you control the window attributes (toolbar, scrollbars, left and right
exc.) when using the hyperlink control as you would when using javascript?

For examle, I am using the following javascript to open another window and
would like to control these attributes with the hyperlink control:
window.open(msgSubmitterInfo,t,s);return false"
var s="toolbar=no,directories=no,scrollbars=yes,resizable=yes,";
s+= "left=200,top=100,width=500,height=400";

 

[Kevin Spencer]

Those aren't attributes; they're parameters, which are passed to the
JavaScript window.open() method. Now, you certainly CAN make the URL of a
hyperlink point to a JavaScript method call:

<a href="javascript:window.open(...)">Click Here</a>

--
HTH,
Kevin Spencer
..Net Developer
Microsoft MVP
I get paid good money to
solve puzzles for a living

 

[Guest]

Kevin, along these lines, is there any other way to insert code into an href
without using the "javascript:"? I am allowing users to define certain links
in my system, and want to make sure I filter out anything that might be
malicious. Thanks.

Those aren't attributes; they're parameters, which are passed to the
JavaScript window.open() method. Now, you certainly CAN make the URL of a
hyperlink point to a JavaScript method call:

<a href="javascript:window.open(...)">Click Here</a>

--
HTH,
Kevin Spencer
..Net Developer
Microsoft MVP
I get paid good money to
solve puzzles for a living

 

[Kevin Spencer]

Kevin, along these lines, is there any other way to insert code into an
href

without using the "javascript:"?

Afraid not, Bill. You'll have to think of a secure way of doing what you
want. If you want JavaScript in hyperlinks, you will get JavaScript in
hyperlinks. The "javascript:" has nothing to do with it, other than
informing the browser that the hyperlink is to a JavaScript function, rather
than to an HTTP URL.

--
HTH,
Kevin Spencer
..Net Developer
Microsoft MVP
I get paid good money to
solve puzzles for a living

Kevin, along these lines, is there any other way to insert code into an href
without using the "javascript:"? I am allowing users to define certain links
in my system, and want to make sure I filter out anything that might be
malicious. Thanks.

 

[Guest]

If I understand you right, I think that's a good thing. Aren't you saying
that if the "javascript:" is not there the browser won't try to "run" it, in
which case I can just exclude any user-defined links that include
"javascript" (e.g. I just remove the word and let the browser give a 404 when
somebody clicks on that "link")?

 

[Kevin Spencer]

Hi Bill,

If I understand you right, I think that's a good thing. Aren't you saying
that if the "javascript:" is not there the browser won't try to "run" it, in
which case I can just exclude any user-defined links that include
"javascript" (e.g. I just remove the word and let the browser give a 404 when
somebody clicks on that "link")?

Correct, as long as we're talking about the href of a hyperlink. Make sure
that they can't add any "onclick" attributes, though, as that would be able
to call JavScript without the "javascript:".

--
HTH,
Kevin Spencer
..Net Developer
Microsoft MVP
I get paid good money to
solve puzzles for a living

 

[Guest]

Got it, thanks.

Hi Bill,


Correct, as long as we're talking about the href of a hyperlink. Make sure
that they can't add any "onclick" attributes, though, as that would be able
to call JavScript without the "javascript:".

--
HTH,
Kevin Spencer
..Net Developer
Microsoft MVP
I get paid good money to
solve puzzles for a living