Leave a comment at the end of this page or email contact@krishagni.com
Why was HTML formatting removed from Form Field Labels?
From version 11.x onward, OpenSpecimen does not support HTML formatting in the Form field caption (Display Label) for the following reasons.
Key Concerns and Details
Concern | Details |
|---|---|
CSV Exports and Bulk Imports | In older versions, full HTML code appeared in CSV exports and bulk import templates. |
Query Module | In older versions, full HTML code appeared in the column headers of query results. This made the user interface difficult to read. |
Security Risks | HTML content and images can lead to Cross-Site Scripting (XSS) security flaws. For example, a user could add an image tag that connects to a harmful website. When other users open the form to enter or view data, the browser loads that harmful website automatically. Users do not need to click anything to trigger this action. OpenSpecimen removed HTML support from field labels to block these security risks. |
These behaviors display raw HTML code. This causes data readability problems, incorrect rendering, and security risks.
Users can still use HTML formatting in the form by using the Note field. See the wiki page for details.