Thread

I’m trying to allow the embedding of youtube (and vimeo) videos. Under the control panel one of my fields is a textarea (default text format = none). When I input the iframe embed code it looks ok.

But on output and when I return to edit the record the <iframe ...> and </iframe> tags have been converted to their html entitites. They become <iframe…  and </iframe>

I’m guessing this is because global_xss_filtering is set to true. But how do I “stop” this on this field only. So people can simply input <iframe ...></iframe> video embed code?

why don’t you just use the input field to store the id of the video you want to embed ?

your output could look like this

{exp:channel:entries channel="videos"}
<iframe src="youtube.com/embedcode/{video_id}"></iframe>
{/exp:channel:entries}

this way clients shouldn’t have to to bother with HTML. Which will make their and your life easier 😊

A good, viable idea. However, one that’s not totally user friendly. Most users know how to copy YouTube’s embed code. To have them use only the video ID value would require “training”. As simple as it is…I’m sure we’d have to explain it numerous times.

As it is…we grabbed DevDemon’s channel video. It’s not a perfect solution since we have to instruct them on how to copy the “correct” video URL. But it’s an OK temporary solution.

I’m hoping for the simplest, uber solution…. some way to simply permit them to copy and paste the embed code.

Hey there Nuvonium,

What version of ExpressionEngine are you running?

I just tried this with the following code and I have no issues.

<iframe width="560" height="315" src="http://www.youtube.com/embed/Nl39QcbOkJg" frameborder="0" allowfullscreen></iframe>

I can edit the entry and nothing changes.

I am on 2.5.3.

Cheers,

EE2 v2.5.2 - I guess I’ll update to see if that solves the problem.

Thanks. I’ll post back with the results.

Hey Nuvonium,

Sounds good. Please let me know how things go.

Cheers,

Upgraded to EE2 2.5.3 - using a textarea field, formatting of none, still fails when I input iframe embed code from youtube.

The embed code gets “cleansed” and iframe tags are converted to html entities.

Result:
<iframe width=“560” height=“315” src=“http://www.youtube.com/embed/Kk5scrUVcgI” frameborder=“0” allowfullscreen></iframe>

<iframe ...  ></iframe>

Any other ideas?

If under my config.php I disable XSS filtering:

$config[‘global_xss_filtering’] = FALSE;

Then the iframe code works.

But I obviously don’t want to do this…. right?

So how do I get it to work, even with the XSS filter set to TRUE??

Hi Nuvonium,

I am still not able to reproduce this. I have XSS filtering on and I can enter your code exactly and I do not get this results.

Please be on the lookout for an email from EllisLab.

Cheers,

Thanks. Received support email. Replied already.

Hi Nuvonium,

Sounds good!

Thanks,