I have a problem concerning string output on HTML page when using Javascript and ASP. Logic of page generation goes like this:
We use asp page to generate HTML code using
Response.Write(). If string contains numeric character reference (for exampleС) it would show on the user's side just fine as a character.After that we add
OnLoadevent, which calls for a Javascript function. All this happens inside<body><\body>tags. Source for JavaScript added inside<script></script>tags. The function only addsdocument.href, which contains reference to the same asp page.The asp logic loads again and adds some text to the page using
Response.BinaryWrite()(Response.Write can be used all the same) All character references are shown as codes:С. Obviously all '&' symbols become&(asp automatic conversion), browser decodes it as & and we can only see a codeСand not the symbol 'С'.
As far as I know such behaviour can be caused by <script> tags, as a precaution against xss attacks. In the end I want to stop encoding '&' as &.
However here is the most important part:
If I add header with "Content-Type" "text\html", IE (any version) starts encoding NCR symbols in a correct way. But Firefox, Chrome and Safari do not change behavior and keep encoding & as &. I can see several questions on Stack Overflow which looks like mine, yet the situation is not exactly the same (My strings are not inserted directly by JavaScript, so I cannot manipulate output string and change & to &, also my strings have correct symbols in the first place, they get changed by asp or by browser). Is there any elegant way to force Firefox or Chrome to decode page as IE? Maybe some settings or attributes in HTML tags? This problem looks like it depends on a browser to me, am I right?