DataTable column render display html entities securely

topex_psy

I have this stupid hack data in my database:

<script>console.log('LOOOOOOOL'); alert('LOOOOL');</script>Sobat Bulat menjual berbagaimacam jajanan berbentuk bola mulai dari yang manis-manis hingga gorengan. Menu kami antara lain bola udang, bola ayam bawang, bola jagung kentang, dan masih banyak lagi.

then I use datatable with server-side type to display it, then the alert show up. How to prevent it? I've tried to encode the html entities via columnDefs render function but not working. alert still showing up. I want to display it encoded (raw text). please help.

kthorngren

What alert are you seeing?

The alert should have a link to troubleshooting steps. That would be the place to start.

We will need more info to help.

• What are the results of following the steps provided in the alert link?
• What is your Datatable config.
• What is the actual response data using the browsers dev tools > network output?

Or you can post a link to your page for help in troubleshooting.

Kevin

topex_psy

I mean a standard alert that coming from this string data <script>... alert('LOOOOL');</script> .... I want to just display it as text in my DataTable column, so don't run it at is real javascript command.

kthorngren

Sorry, I misunderstood the question. You can use a renderer list the text renderer or build your own custom render using columns.render.

Kevin

topex_psy

thank you. because I have use my own custom renderer function, so I used it like this way: https://datatables.net/forums/discussion/50733/fn-datatable-render-text-combine-with-render-function-data-type-row