missing support of URLs with Json-String {…}

Hi there,

interesting. For me, the error is different. It just cuts it by the first {, which then creates the following iframe:

<iframe src="https://api.trustyou.com/hotels/e3704903-5040-474d-9af3-42fd0a985976/meta_review.html?key=d909b418-8508-40cb-84d4-1e35bce01a17&amp;display=full&amp;scale=5&amp;custom_style={" primarycolor=""></iframe>

I’ll check it, but nevertheless this URL seems to be in a non-proper format. Such data usually should be urlencoded, e.g.:

<iframe src="https://api.trustyou.com/hotels/e3704903-5040-474d-9af3-42fd0a985976/meta_review.html?key=d909b418-8508-40cb-84d4-1e35bce01a17&display=full&scale=5&custom_style=%7B%22primaryColor%22%3A%220x8B1936%22%7D"></iframe>

Then, it also works as designed.

Edit: By the way, I don’t do any URL sanitizing. The problems come from different versions of PHPs DOMDocument, which does such things by itself. However, absolutely differently depending on the system. Best example: I get a different output than you do.

Best regards,
Matthias

• This reply was modified 7 months, 3 weeks ago by Matthias Kittsteiner.

After further investigation, I also must say that I cannot support that. Quotation marks are not allowed within HTML attributes, since they break the HTML code, as quotation marks are used to delimit the value of an attribute.

As per the example above:

<iframe src="https://api.trustyou.com/hotels/e3704903-5040-474d-9af3-42fd0a985976/meta_review.html?key=d909b418-8508-40cb-84d4-1e35bce01a17&display=full&scale=5&custom_style={"primaryColor":"0x8B1936"}"></iframe>

Here, the "> delimits the src of the iframe. However, since there already are quotation marks before, the src ends after the {. The actual processed HTML is:

<iframe src="https://api.trustyou.com/hotels/e3704903-5040-474d-9af3-42fd0a985976/meta_review.html?key=d909b418-8508-40cb-84d4-1e35bce01a17&display=full&scale=5&custom_style={" primaryColor=":" 0x8B1936="}"></iframe>

As you can see, we now have some new properties for primaryColor and 0x8B1936.

I cannot fix this on my side, because I require HTML to be valid.