jQuery get html in div without any markup

Question

I have some script written using the jQuery framework.

var site = {
link: $('#site-link').html()

}

This gets the html in the div site-link and assigns it to link. I later save link to the DB.

My issue is I don't want the html as I see this as being to dangerous, maybe?

I have tried:

 link: $('#site-link').val()

... but this just gives me a blank value.

How can I get the value inside the div without any markup?

score 2 · Accepted Answer · answered May 03 '13 at 08:58

2

Try doing this:

$('#site-link').text()

From the jQuery API Documentation:

Get the combined text contents of each element in the set of matched elements, including their descendants, or set the text contents of the matched elements.

answered May 03 '13 at 08:58

Piet van Dongen

1,629
10
13

score 2 · Answer 2 · answered May 03 '13 at 09:03

2

Use the .text() jquery method like this:

    var site = {
        link: $('#site-link').text()
    }

Here is an example of what .val(), .html() and .text() do: jsfiddle example

answered May 03 '13 at 09:03

97ldave

5,249
4
25
39

score 1 · Answer 3 · answered May 03 '13 at 08:59

1

Use the text() method.

Get the combined text contents of each element in the set of matched elements, including their descendants, or set the text contents of the matched elements.

answered May 03 '13 at 08:59

Quentin

914,110
126
1,211
1,335

score 1 · Answer 4 · answered May 03 '13 at 09:01

1

Use the .text() function of jQuery to get the only text.

var site = {
link: $('#site-link').text()

}

answered May 03 '13 at 09:01

score 0 · Answer 5 · answered May 03 '13 at 09:05

0

to avoid html, you will be required to use text() method of jquery.

var site = {
link: $('#site-link').text()

}

http://api.jquery.com/text/

answered May 03 '13 at 09:05

Ganesh Bora

1,133
9
17

score 0 · Answer 6 · edited May 23 '17 at 12:14

If you are planning to store the result in the database and you are concerned about HTML, than using something like .text() rather than .html() is just an illusion of security.

NEVER EVER trust anything that comes from the client side!

Everything on the client side is replaceble, hijackable by the client rather easily. With the Tamper Data firefox plugin for example, even my mother could change the data sent to the server. She could send in anything in place of the link. Like malicious scripts, whole websites, etc...

It is important that before saving the "link" to the database you validate it on the server side. You can write a regex to check if a string is a valid url, or just replace everything that is html.

It's also a good idea to html encode it before outputting. This way even if html gets into your database, after encoding it will be just a harmless string (well there are other stuff to be aware of like UTF-7, but the web is a dangerous place).

jQuery get html in div without any markup

6 Answers6