javscript - setting form field in an iframe

**Greg Griffiths** · Jul 23 '05, 05:27 PM

Re: javscript - setting form field in an iframe

It could be a security issue, copy all the code and IFRAMES to you local
machine and then retry.

Bob wrote:
[color=blue]
> I'm a total newbie at Javascript, but a programmer for over 20 years...
> so, my plans may be bigger than they are possible.
>
> I'm trying to set with Javascript the value of a form field... easy
> enough, right?
>
> e.g. this successfully sets the local form's field:
>
> document.thetes tform.mycity.va lue='paris';
>
> however, I'm not sure how to do the same for a form that's within an
> iframe, e.g. (consider that the remote url at example.com has 2 forms in
> it; the 2nd frame contains a field called 'city' that I want to set):
>
> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
> <html>
> <head>
> <meta http-equiv="content-type"
> content="text/html;charset=IS O-8859-1">
> <SCRIPT LANGUAGE="JavaS cript" type="text/javascript">
> 
> </SCRIPT>
> </head>
> <body bgcolor="#fffff f">
> <form action="test.vs p" method="get" name="thetestfo rm"
> enctype="applic ation/x-www-form-urlencoded">
> <p><img src="clickme.gi f" alt="" width="90" height="65" border="0"
> onclick="setfie lds()"></p>
> <input type="text" name="mycity" size="24">
> <input type="submit" name="submit">
> </form>
> <IFRAME name="theiframe "
> SRC="http://www.example.com/cityinfo.html" width="95%" height="90%"
> scrolling="auto " frameborder="1" >
> </IFRAME>
>
> </body>
> </html>
>
> this line doesn't seem to kick:
>
> document.theifr ame.document.fo rms[1].city.value='pa ris';
>
> unfortunately, the form on the example.com site does not have a name for
> referencing, so I have to reference it as forms[1]... I understand that
> this might make the form read only... is there a way to reference it
> that's not read only? (or am I off base in my diagnostic?)
>
> the example.com is not a site that I have any control over... gotta work
> with what I gots.
>
> thanks much, javascript gurus and galus.
> B.[/color]

**Randell D.** · Jul 23 '05, 05:27 PM

Re: javscript - setting form field in an iframe

Bob wrote:
[color=blue]
> I'm a total newbie at Javascript, but a programmer for over 20 years...
> so, my plans may be bigger than they are possible.
>
> I'm trying to set with Javascript the value of a form field... easy
> enough, right?
>
> e.g. this successfully sets the local form's field:
>
> document.thetes tform.mycity.va lue='paris';
>
>
>
>
> however, I'm not sure how to do the same for a form that's within an
> iframe, e.g. (consider that the remote url at example.com has 2 forms in
> it; the 2nd frame contains a field called 'city' that I want to set):
>
>
>
>
> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
> <html>
> <head>
> <meta http-equiv="content-type"
> content="text/html;charset=IS O-8859-1">
> <SCRIPT LANGUAGE="JavaS cript" type="text/javascript">
> 
> </SCRIPT>
> </head>
> <body bgcolor="#fffff f">
> <form action="test.vs p" method="get" name="thetestfo rm"
> enctype="applic ation/x-www-form-urlencoded">
> <p><img src="clickme.gi f" alt="" width="90" height="65" border="0"
> onclick="setfie lds()"></p>
> <input type="text" name="mycity" size="24">
> <input type="submit" name="submit">
> </form>
> <IFRAME name="theiframe "
> SRC="http://www.example.com/cityinfo.html" width="95%" height="90%"
> scrolling="auto " frameborder="1" >
> </IFRAME>
>
> </body>
> </html>
>
>
>
>
> this line doesn't seem to kick:
>
> document.theifr ame.document.fo rms[1].city.value='pa ris';
>
>
>
> unfortunately, the form on the example.com site does not have a name for
> referencing, so I have to reference it as forms[1]... I understand that
> this might make the form read only... is there a way to reference it
> that's not read only? (or am I off base in my diagnostic?)
>
> the example.com is not a site that I have any control over... gotta work
> with what I gots.
>
>
> thanks much, javascript gurus and galus.
> B.[/color]

The only way this is possible is if your main page, and 'sub page' (be
it a iframe, frame or popup) are hosted from the same domain. This is
not clear from your example code above...

What is the problem?

Its a security issue and if you do manage to resolve it, the results
will be unreliable because many browsers have closed this hole a few
years ago.

If your intentions are for the best, then think... Think of one frame
1pixel wide, 1pixel long hidden in a page somewhere - If you could do
what you want to do, you could read the form input like someone's
username/password meant for another website - perhaps bank details -
whatever - and save them by auto-posting your form...

cheers
randelld

**Bob** · Jul 23 '05, 05:28 PM

Re: javscript - setting form field in an iframe

In article <KAmLd.228440$8 l.128239@pd7tw1 no>,
"Randell D." <reply.via.news .group.only.tha nks@fiprojects. moc> wrote:
[color=blue]
> Bob wrote:
>[color=green]
> > I'm a total newbie at Javascript, but a programmer for over 20 years...
> > so, my plans may be bigger than they are possible.
> >
> > I'm trying to set with Javascript the value of a form field... easy
> > enough, right?
> >
> > e.g. this successfully sets the local form's field:
> >
> > document.thetes tform.mycity.va lue='paris';
> >
> >
> >
> >
> > however, I'm not sure how to do the same for a form that's within an
> > iframe, e.g. (consider that the remote url at example.com has 2 forms in
> > it; the 2nd frame contains a field called 'city' that I want to set):
> >
> >
> >
> >
> > <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
> > <html>
> > <head>
> > <meta http-equiv="content-type"
> > content="text/html;charset=IS O-8859-1">
> > <SCRIPT LANGUAGE="JavaS cript" type="text/javascript">
> > 
> > </SCRIPT>
> > </head>
> > <body bgcolor="#fffff f">
> > <form action="test.vs p" method="get" name="thetestfo rm"
> > enctype="applic ation/x-www-form-urlencoded">
> > <p><img src="clickme.gi f" alt="" width="90" height="65" border="0"
> > onclick="setfie lds()"></p>
> > <input type="text" name="mycity" size="24">
> > <input type="submit" name="submit">
> > </form>
> > <IFRAME name="theiframe "
> > SRC="http://www.example.com/cityinfo.html" width="95%" height="90%"
> > scrolling="auto " frameborder="1" >
> > </IFRAME>
> >
> > </body>
> > </html>
> >
> >
> >
> >
> > this line doesn't seem to kick:
> >
> > document.theifr ame.document.fo rms[1].city.value='pa ris';
> >
> >
> >
> > unfortunately, the form on the example.com site does not have a name for
> > referencing, so I have to reference it as forms[1]... I understand that
> > this might make the form read only... is there a way to reference it
> > that's not read only? (or am I off base in my diagnostic?)
> >
> > the example.com is not a site that I have any control over... gotta work
> > with what I gots.
> >
> >
> > thanks much, javascript gurus and galus.
> > B.[/color]
>
>
>
> The only way this is possible is if your main page, and 'sub page' (be
> it a iframe, frame or popup) are hosted from the same domain. This is
> not clear from your example code above...
>
> What is the problem?
>
> Its a security issue and if you do manage to resolve it, the results
> will be unreliable because many browsers have closed this hole a few
> years ago.
>
> If your intentions are for the best, then think... Think of one frame
> 1pixel wide, 1pixel long hidden in a page somewhere - If you could do
> what you want to do, you could read the form input like someone's
> username/password meant for another website - perhaps bank details -
> whatever - and save them by auto-posting your form...
>
> cheers
> randelld[/color]

Like Randell guessed, the inner page is not coming from my domain, it's
an external page.

thanks for the heads up, I'm screwed with this approach.

saved me wasting more time, thanks.
B

javscript - setting form field in an iframe

javscript - setting form field in an iframe

Comment

Comment

Comment