Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: warning about SQL injection

...

This is great, but only works when the macro in question was designed to accept the "rich text" XHTML generated by another macro. For example, but the SQL Query macro can't take macro output as its input.

...

Dynamic Wrapper Macros

Why would we want to send dynamic content to a macro not expecting it? Here are a few situations:

  • You are using the SQL macro to query a database, but want to use a HTTP parameter from the URL (param macro) in the query to make it dynamic. This is a simple alternative to the Self-Service Reports Plugin.
  • You want to use SQL results in Javascript in a html macro.

Dynamic Wrapper Macros

  • For instance, one might like to use a modern Javascript graphing library like Chart.js, fed with data from your SQL back-end.

The solution is to create a wrapper user macro that accepts rich text input, strips out any XHTML tags, and feeds the resulting plain text to the macro you're interested in.

...

The first example lets the SQL Query macro take dynamic input. Here is a silly example, with SQL that emits XHTML for a Confluence @user reference, (/) tick and a custom param user macro:

rendering as:

Warning

This is a silly example not least because of the SQL injection attack using param like this involves.

 

 

The macro definition looks like this:

...