Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p><strong>1) Why isn't the text being entered into the textbox being added to the list</strong></p> <p>As stated by others, you are not persisting the data between requests.<br> When ever you click a button the whole page is re-instantiated, causing your <code>message</code> variable to re-set itself.</p> <p><code>Session</code> can be used. For example replace your <code>message</code> field with a property like this:</p> <pre><code>private List&lt;string&gt; Messages { get { var messages = Session["Messages"] as List&lt;string&gt;; if (messages == null) { messages = new List&lt;string&gt;(); Session["Messages"] = messages; } return messages; } } </code></pre> <p><strong>2) Why is the new HTML being displayed as plain text.</strong></p> <p><em>(On a side-note <code>&lt;ol&gt;</code> tags inside a <code>&lt;span&gt;</code> is invalid Html, even though it may render)</em> </p> <p>You are encoding your <code>output</code>.<br> To get the desired result you simply don't encode it like this: </p> <p><em>(I'm not 100% sure on this but I think when running through IIS on a live system IIS may auto-encode the strings and you have the same issue again, look at suggested <code>BulletList</code> as alternative if that is the case.)</em></p> <pre><code>protected void Button4_Click(object sender, EventArgs e) { string output = "&lt;ol&gt;"; foreach (string message in Messages) { output += "&lt;li&gt;"; output += message; output += "&lt;/li&gt;"; } output += "&lt;/ol&gt;"; Message.InnerHtml = output; } </code></pre> <p>An alternative would be the use of a <code>BulletList</code> using the <code>BulletStyle</code> of <code>Numbered</code> to get the same result.<br> Update your <code>Html</code> like this:</p> <pre><code>&lt;div&gt; Key Messages:&lt;br /&gt; &lt;span id="Message" runat="server"&gt; &lt;asp:TextBox runat="server" ID="TextBox2" Width="500px"&gt;&lt;/asp:TextBox&gt; &lt;asp:Button runat="server" ID="Button2" Text="Enter Message" OnClick="Button2_Click" /&gt; &lt;asp:Button runat="server" ID="Button3" Text="Clear Messages" OnClick="Button3_Click" /&gt; &lt;asp:Button runat="server" ID="Button4" Text="Done" OnClick="Button4_Click" /&gt; &lt;/span&gt; &lt;asp:BulletedList BulletStyle="Numbered" ID="OutputMessages" runat="server"&gt; &lt;/asp:BulletedList&gt; &lt;/div&gt; </code></pre> <p>Change the code in the <code>Button4_Click</code> to this:</p> <pre><code>protected void Button4_Click(object sender, EventArgs e) { // If you want to hide the message controls. Message.Visible = false; foreach (var message in Messages) { OutputMessages.Items.Add(new ListItem(Server.HtmlEncode(message))); } } </code></pre> <p><strong>Summary</strong></p> <ul> <li>Persist your data, using for example the <code>Session</code></li> <li>Don't encode your data if you want the html you pass to render (Read warning below)</li> <li>Consider using a <code>BulletList</code> instead of sending back unsafe strings of html</li> <li>A <code>&lt;ol&gt;</code> tag inside a <code>&lt;span&gt;</code> is invalid html</li> </ul> <p><strong>Warning on Encoding</strong> </p> <p>When not encoding data coming down from the server it would be possible to send down malicious scripts. For example, say we do the following:</p> <pre><code>Message.InnerHtml = "&lt;script&gt;alert('Hello');&lt;/script&gt;"; </code></pre> <p>The above would execute the script showing the alert. Imagine this being a malicious script! </p> <p><em>However, as mentioned above, IIS may auto-encode the strings in which case this script would not execute but should render as plain text.</em></p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload