Thread

I try to embed an Iframe object (a vimeo embed) in a safecracker form in combination with the wygwam editor. In the wygwam editor I can see an iframe placeholder but when submit that entry and view the brackets around the iframe tag are replaced by their corresponding html entities.

If I edit this channel entry from inside the EE admin panel everything works fine.

I am using EE 2.1.4 and Wygwam 2.2.2. The guys from Pixel and Tonic say it must be a safecracker issue.

Please also have a look at the Pixel and Tonic ticket page.

Thanks for your help!

Welcome to the ExpressionEngine forums,

Since you’re new to the EE forums, have you seen EEWiki:// How to Post a Support Request?

You mentioned your EE and your Wygwam version, but not your SafeCracker version. Is this the 2.0 or the 1.3 version of SafeCracker?

Hi Sue,

thanks for the welcome.

Safecracker version: 2.0
EE build: 20101220

I’m confused. You said EE 2.1.4 which is dated 20110201 - are you certain that’s the right version?

Also, the guys at Pixel and Tonic didn’t say EE 2.1.4 was at fault, just that that may be what the problem was.

At least one of the dev team at Pixel and Tonic said they couldn’t replicate the issue, and asked for login details.

Are you the person that posted that support request?

Can you post your SafeCracker form so we can attempt to duplicate the problem? Are you using something other than the basic or full implementation of Wygwam?

Please also do verify the version of EE you’re using.

Indeed it is really confusing:

My EE admin panel says it is EE version 2.1.4 and build number is 20101220. I know that I downloaded and installed EE version 2.1.3 non-commercial. I updated over an Freelancer license, maybe that´s the reason for the wrong version number.

Yes I am the person who posted the support request to Pixel and Tonic. I gave them a login and they replied that:

“If it’s working outside of Safecracker, then this is almost certainly an issue with Safecracker encoding the HTML and not taking it as a literal string.”

I use nothing special other than the basic and full implementation of Wygwam on the related form. On other forms I also use a flickr embed button from http://devot-ee.com/add-ons/flickr/ .

This is my safecracker form where the field news_content is the wygwam field:

Thanks,
Lars.

Lars,

My EE admin panel says it is EE version 2.1.4 and build number is 20101220. I know that I downloaded and installed EE version 2.1.3 non-commercial. I updated over an Freelancer license, maybe that´s the reason for the wrong version number.

EE2.1.4 is specifically a beta version. You would have had to download the beta version and upgrade or install it for that to happen.

What version of EE Freelancer did you upgrade from? Did you follow the version or build update instructions?
have you still got the zip handy that you downloaded? What is it called?

Lets get this sorted first before concentrating on your SC issue

Hi John,
first thank you for your efforts.

I upgraded from Freelancer version 2.1.3 build number 20101220. Unfortunately I do not have the zip file anymore. But I got my Freelancer license from the FusionAds bundle and as I remember I downloaded it one the first day it was available (January, 10th).

I followed the build update instructions (http://ellislab.com/expressionengine/user-guide/installation/update_build.html)

What exactly is in the iframe?

I’m having the same problem, only not with Wygwam. Just a plain textarea in Safecracker. I have an entry with an iframe for youtube video embed in that field. When I edit the field with SC the iframe tag brackets are converted to entities and the code displays on the page instead of being rendered. This doesn’t happen if I edit it in the CP, only in SC.

So I don’t think it has anything to do with Wygwam and everything to do with SC.

Here an example of the original content of that textarea field:

<iframe title="YouTube video player" width="420" height="345" src="http://www.youtube.com/embed/rBvE9JjD-6I?rel=0" frameborder="0" allowfullscreen></iframe>

and here’s what happens after save in SC:

<iframe title="YouTube video player" width="420" height="345" src="http://www.youtube.com/embed/rBvE9JjD-6I?rel=0" frameborder="0" allowfullscreen></iframe>

Is there a setting somewhere to stop SC from converting these to entities? Otherwise it’s impossible to post these types of embed codes within an entry created or edited by SC.

***edit - woops that code failed. Looks like the forum is converting back the entity instead of displaying as code. Just imagine in the second example most of the opening and closing guys as & l t ; and & g t ;.

Interesting: http://barrettnewton.com/forums/viewthread/1595/P0/

Looks like a more complicated issue than I thought it would be. Is there still no workaround apart from core code hacks?

Seems like a fairly crippling flaw in EE/SC since I imagine heaps of people want to put embed scripts (or any HTML for that matter) into textareas in SC.

I was planning on letting people use simple tags like < b > and < i > to format text but I guess I have to rethink that as well since they will be converted to entities. This is bad news!

Hi, guys,

The additional security is a good idea, especially since this is a front-end and you can use SC to allow guests to post. 

What you should be able to do is use BBCode for formatting.  There are also some add-ons that let you pull in videos from popular video sites that could make that both a more pleasant experience and more secure.  See these video options on Devot-ee.

Another option is to put your media player code in your template, and simply have the user enter the URL to their video file.  That way there are no brackets to be encoded.

Will any of those solutions work for you guys?

Great suggestions Lisa. Sounds like I can get one of those options to work.

Does BBCode work automatically even in SC?

You know, I honestly haven’t tested it; it will still have to run through the template parser so it certainly should.  If it doesn’t I’d be very surprised.

I nuked my local installation accidentally so I can’t test it right this moment; if you don’t have a chance to test it, I’ll do so tomorrow or ask a member of my team to do so.  Sorry about that, I had a ... um, bad moment.  We don’t need to go into details, do we? =)

You’re forgiven! I’ll test today and see if it works for me.

For anyone else reading this….

Antenna (http://devot-ee.com/add-ons/antenna/) is awesome. Worked more elegantly than my original video embed solution and bypasses the issue mentioned above. I put it in a Matrix field so they can easily add more videos/rows.

For BBCode in SC forms I can confirm that it works in plain text inputs or textareas but it looks like not in Matrix (the BBCode get’s rendered as text).

Thanks for the solutions Lisa. I just hope I don’t run into a case where I need actual HTML code in a SC form.