CiviCRM Community Forums (archive)

found that this guy is doing it in the api.php file --- CRM_Utils_API_HTMLInputCoder::singleton(). Any concerns with commenting this out? and this is the actual piece in the Utils (line 129 $values = str_replace(array('<', '>'), array('&lt;', '&gt;'), $values);

Im just trying to get all of my html passed in as is via the api

The HTMLInputCoder isn't exactly beautiful -- ideally, it wouldn't exist. The issue is that at some point (in the prehistorical times of antiquity), someone decided that "first_name", "last_name", and many other (non-HTML) fields should use the "escape-on-input" pattern (where all inputs are escaped and then written to the canonical data-store as escaped-HTML) instead of the more common "escape-on-output" pattern (where the canonical data-store has... pristine data... which must be escaped before being printed to the screen). Escape-on-input is rather weird/unusual for APIs, so we try to hide it when one uses the API (by calling HTMLInputCoder). But it breaks down when the field really is supposed to store HTML content.

Anyway, perhaps it would make sense for us to generalize your work-around: any custom "Note" field should be "skipped" by HTMLInputCoder...

What about other pre-existing fields (e.g. Notes) -- is there any safe way to create entries containing HTML with the API without modifying the Civi core?