{"action":"created","issue":{"url":"https://api.github.com/repos/knockout/knockout/issues/1837","labels_url":"https://api.github.com/repos/knockout/knockout/issues/1837/labels{/name}","comments_url":"https://api.github.com/repos/knockout/knockout/issues/1837/comments","events_url":"https://api.github.com/repos/knockout/knockout/issues/1837/events","html_url":"https://github.com/knockout/knockout/issues/1837","id":98722850,"number":1837,"title":"Unable to properly escape script tags in knockout templates","user":{"login":"Dmitri-Sintsov","id":1751543,"avatar_url":"https://avatars.githubusercontent.com/u/1751543?v=3","gravatar_id":"","url":"https://api.github.com/users/Dmitri-Sintsov","html_url":"https://github.com/Dmitri-Sintsov","followers_url":"https://api.github.com/users/Dmitri-Sintsov/followers","following_url":"https://api.github.com/users/Dmitri-Sintsov/following{/other_user}","gists_url":"https://api.github.com/users/Dmitri-Sintsov/gists{/gist_id}","starred_url":"https://api.github.com/users/Dmitri-Sintsov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Dmitri-Sintsov/subscriptions","organizations_url":"https://api.github.com/users/Dmitri-Sintsov/orgs","repos_url":"https://api.github.com/users/Dmitri-Sintsov/repos","events_url":"https://api.github.com/users/Dmitri-Sintsov/events{/privacy}","received_events_url":"https://api.github.com/users/Dmitri-Sintsov/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-08-03T11:26:07Z","updated_at":"2015-08-05T10:06:47Z","closed_at":"2015-08-03T21:27:21Z","body":"I have knockout template foreach binding for Django inline formsets. These formsets may have custom form field widgets that include javascript code in script tags. These scripts are executed too early from the html template source when page is loaded instead of executing during knockout foreach afterRender. I was googling for the solution but only found unresolved angularjs issue:\r\n\r\nhttps://github.com/angular/angular.js/issues/2820\r\n\r\nHow can I escape the content of knockout script template so it will not be executed during page load? For example I can encode html entities at server-side, then decode it via jQuery:\r\n\r\n\tApp.htmlEncode = function(value) {\r\n\t\treturn $('<div/>').text(value).html();\r\n\t};\r\n\r\n\tApp.htmlDecode = function(value) {\r\n\t\treturn $('<div/>').html(value).text();\r\n\t};\r\n\r\nDo I need to write custom binding provider to do that? Can an expert explain please?"},"comment":{"url":"https://api.github.com/repos/knockout/knockout/issues/comments/127945050","html_url":"https://github.com/knockout/knockout/issues/1837#issuecomment-127945050","issue_url":"https://api.github.com/repos/knockout/knockout/issues/1837","id":127945050,"user":{"login":"mbest","id":1230364,"avatar_url":"https://avatars.githubusercontent.com/u/1230364?v=3","gravatar_id":"","url":"https://api.github.com/users/mbest","html_url":"https://github.com/mbest","followers_url":"https://api.github.com/users/mbest/followers","following_url":"https://api.github.com/users/mbest/following{/other_user}","gists_url":"https://api.github.com/users/mbest/gists{/gist_id}","starred_url":"https://api.github.com/users/mbest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbest/subscriptions","organizations_url":"https://api.github.com/users/mbest/orgs","repos_url":"https://api.github.com/users/mbest/repos","events_url":"https://api.github.com/users/mbest/events{/privacy}","received_events_url":"https://api.github.com/users/mbest/received_events","type":"User","site_admin":false},"created_at":"2015-08-05T10:06:47Z","updated_at":"2015-08-05T10:06:47Z","body":"As far as I can tell, running inline scripts within a \"template\" isn't a simple task. jQuery does do this if you use it to insert a script node, but although Knockout will use jQuery, if available, to parse the template source, it doesn't use jQuery to insert the nodes. But you could probably use a simple custom binding to do it. Here's what I think it could be (but I haven't tested it):\r\n\r\n```html\r\n<div data-bind=\"foreach: forms\">\r\n    <div data-bind=\"djangoWidget: 'empty_form_{{ loop.index }}'\"></div>\r\n</div>\r\n```\r\n\r\n```javascript\r\nko.bindingHandlers.djangoWidget = {\r\n    init: function(element, valueAccessor, allBindings, viewModel, bindingContext) {\r\n        var templateId = valueAccessor(),\r\n            templateElement = document.getElementById(templateId),\r\n            templateContents = templateElement.value;\r\n        $(element).append(templateContents);\r\n    }\r\n};\r\n```"}}