current community

your communities

more stack exchange communities

Stack Exchange
tour help
stack overflow careers
Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free.
up vote 0 down vote favorite

Basically my problem is that when i fetch data using $http.get method of the AngularJS , the Json encoded data which is printed by the PHP doesnt render in the website instead it shows as plain text.. for ex when PHP prints <h3 class=\"someclass\">Hello World<\/div>" and also simultaneously i try to parse the JSON using JSON.parse but it gives me Syntax Error: Unexpected token o . Basically the received HTML markup is not rendered.. Its just as plain text.. See below:

enter image description here

The h3 tag that i rectangled in black doesn't render in the page. Even in the source you can see its not as a markup but as a plain text.

share|improve this question
    
Can you post the JSON so we can see what's wrong with that? –  opatut Jan 22 at 7:27
    
the json that php encoded is Object {failData: "<h3 class="emptyBox">Write Your 1st Note !!</h3>"} controller.js:19 –  ChanX Jan 22 at 7:37
    
That is no valid JSON. Assuming we're talking about parsing {failData....}, there is wrong quote nesting. The string failData is only "<h3 class=", after that is only gibberish. To create JSON strings in PHP, use json_encode: php.net/manual/de/function.json-encode.php –  opatut Jan 22 at 7:42

2 Answers 2

up vote 0 down vote

There is a pretty good answer on escaping/not escaping HTML in angular here: http://stackoverflow.com/a/19417443/402551

It is a security feature that text injected into the DOM is not parsed as HTML, which saves you against some XSS attacks and the like. You have to manually ensure that it is rendered, so you need to think about the security implications yourself. Please familiarize yourself with XSS mechanisms and sanitize your input, before you bypass the escaping.

In general, Angular is designed in a way that you do not render any HTML server-side, just supply your frontend with the data and render there. This way, you won't have most of these problems. Please review, whether you can change that in your project.

share|improve this answer
    
let me see on it.. –  ChanX Jan 22 at 7:38
up vote 0 down vote

Use ng-bing-html to escape HTML content from the response,

While getting the response do as below,

$scope.temp_variable=$sce.trustAsHtml(response);

In your HTML display the value like this,

<div>
    <span ng-bind-html="temp_variable"></span>
</div>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.