CSS and function()

Forum Rules

Helios_Multi TPoxygen11final

[maccasenior]

Hi! Thanking anyone for a reply. Blog - Blogger Blog, IE7. I'm just starting to learn about CSS and would like to know:

Q. Can I run a function eg. function gotoshow () within a blogger blog or do I have to have a self hosted site for this?

Regards
Peter

[goatlady]

Hey Peter,

CSS is not a scripting language, it's a markup language - it doesn't have things like variables and functions.

Are you perhaps thinking of JavaScript or PHP?

If it's JavaScript, I believe you can run anything you like on a Blogger blog. But if you mean PHP, then you do need to be self-hosted.

Hope that helps!

[maccasenior]

Hi goatlady and thank you. This example at:

http://www.dynamicdrive.com/dynamicindex14/image4.htm

is what I've tried to put into my blog. All works well except for the links for each image. An error comes up with the function gotoshow(). I'm guessing I need to be self hosted. The link to the image was a workaround but not satisfactory.

Regards,
Peter

[macgirvin]

There are a couple of gotchas. First the 'filter:' CSS construct is only available on IE and I don't think there are any plans to support it in FF.

But even if this was OK with you, you may run into a problem using Javascript functions from CSS on blogger (or any community site). It all depends on how strict their XSS filtering is - but some of the most infamous hacker attacks of the last few years have been accomplished through embedded javascript in style sheets.

Blogger/Google will have to have a filter to trap badness. I don't know what they allow and what they don't but it is customary in the industry to disallow any attempts at code execution in style information. Most other community sites disallow javascript (and CSS) altogether because there are only about a half million ways to exploit it and steal another person's session.

Google has the resources to parse the entire CSS, check all these half a million different exploits and make a decision about whether or not there's evil code in it. But evil XSS code almost always contains either "javascript:" or "filter:" - so your CSS is going to be highly scrutinized and quite possibly changed when you submit it. 

[goatlady]

Hi goatlady and thank you. This example at:
http://www.dynamicdrive.com/dynamicindex14/image4.htm

Ahh, that explains it. Like macgirvin explained, that's actually using JavaScript functions within the CSS and it's IE only. I would avoid hacks like this like the plague - they are very difficult to get right and then will only show for a section of your audience anyway.

[maccasenior]

Hi Macgirvin and Goatlady. Thank you so much for the detailed advise you have given me. It is greatly appreciated.

To Macgirvin: What you have explained to me is pretty hair-raising. I had no idea. From the link I supplied I was able to get the effect I wanted in my blogger blog, except for the links to each changing image. My post was published before I sought this advise. Looking at your advise now, I'm glad the function () didn't work. To date, one person with FireFox has been able to see the effect. As it works for me, I imagine it will work for those with IE. I'm now wondering whether I should delete the post! Thanking you again - Peter.

To Goatlady: Coming from that site, I didn't consider it a hack. I will certainly take your advise on board re future posts.

To both of you again, thank you - take care - Peter

[goatlady]

To Goatlady: Coming from that site, I didn't consider it a hack. I will certainly take your advise on board re future posts.

heh - well, a Microsoft-sanctioned hack. But as far as I'm concerned, a hack nonetheless

[maccasenior]

Hi Goatlady. Please excuse my ignorance. In my endeaavour to learn more, "What is the difference between a hack and accepted code?"

I'm confused as I can see that I'm allowed to enter HTML/Javascript within my blogger blog.

Regards,
Peter

[macgirvin]

I've had a closer look at the source and it appears that the "filter:" only adds a cross-fade between images, and is only enabled for IE. So FF users still see the image rotation, just without a cross-fade.

As for the links - I see that the javascript for gotoshow() isn't even there, but slideit() is. If you indeed uploaded it correctly, you might try again and do a view of the page source to see if it survived intact. My guess is that the gotoshow() function may have gotten filtered out as possibly malicious, either that or you somehow missed pasting it in.

You don't need to remove anything. You aren't doing anything wrong. I'm just alerting you that people do, and sites usually take (undocumented) steps to counteract these things that may affect what you're trying to do.

On most any other multi-user site you wouldn't be able to get the word javascript: into a tag at all. I'm actually impressed that Google is able to allow it.     

[goatlady]

Hi Goatlady. Please excuse my ignorance. In my endeaavour to learn more, "What is the difference between a hack and accepted code?"

I'm confused as I can see that I'm allowed to enter HTML/Javascript within my blogger blog.

Sorry maccasenior - I'm a web developer by trade and guilty of talking jargon at times. Bad goatlady!

Technically speaking, I consider any code that is not included in the W3C's Specifications to be a "hack". This includes pretty much anything that will only work in one browser (typically it's Microsoft that have done this in the past). However, unless you're a web developer there's no way you can be expected to know that, so don't worry about it!

If you need any more help, we're here...

[maccasenior]

Hi Macgirvin. Yes, that's correct, gotoshow() is not there. As that part failed to work after publishing, I removed it and republished again. Thanks heaps for looking into this for me. Take Care - Peter

[maccasenior]

No need to apologise Goatlady. I've learnt heaps from you and Macgirvin. Take care - Peter