Andy Jarrett // Code. Develop. Manage.

InvalidTags in BlogCFC or your CF application

Adding the YouTube vid to my last post caused a little bit of any issue. Mainly the <embed> and <object> tags were replaced with <InvalidTag>. Thinking that Ray had turned into an evil Jedi master and prevented users using these tags I did a quick global find through the BlogCFC code. That left me scratching my head as I couldn't find any reference to it at all so I did what we all do....I went straight to Google. It turns out the cause is a CF Admin setting that specifies whether to protect variables from cross-site scripting attacks. Not to worry though, this can be turned off via the <cfapplication> tag by adding the attribute scriptProtect="none" - Livedocs descriptionRay, sorry for doubting your Jedi master status :o)
I’m here, learning and working away. If you liked this content and want to keep me going, consider buying me a coffee.
Your support keeps this site running and the coffee brewing! ☕️