I created a custom member profile field, and put this in it:

When I output that field, the curly braces are XML escaped:

yields

( I had to add the . into the code because the curly brace entities were getting re-interpretted by the forums.  But you get the idea).

Basically, the custom member profile field should either INTERPRET filedir_6, or it should return the string as entered.  But it shouldn’t escape the curly braces.  This is a significant problem for me, so please do let me know if you can help.

TTFN
Travis

This is an intentional security feature, Travis, otherwise member custom fields could contain variables, embed tags, conditionals, or other things that could wreak havoc.

However, here is a plugin you can use that will parse {filedir_#} variables anywhere they may be output, including those with encoded curly braces.

How does member field data differ from curly braces in weblog content, which does get output without encoding?

TTFN
Travis

End users can edit their own custom profile fields, but only approved content publishers can enter information into weblog entries.  And I realize that you can set a field to be admin-accessible only, so that is something that could possibly be made to allow, but that seems like a lot to expect administrators to keep track of, i.e. “if I set this to this am I allowing such and such to possibly be parsed?”

That’s a good rational—and I see now EE parses braces for comments, too.  I never noticed that.

TTFN
Travis

Glad Derek got you squared away on what’s up.  We good to close this one out?

Yeppers, thanks for the help.

Look’s like we’re done here, so I am closing that one out.