iframe not allowed in product description?

[shughey]

Using the latest version, I tried to enter an iframe in the product description field. When I previewed it I received an error message stating I am not authorized to perform that function. Can iframes not be used in zen cart? It's an external html page with nothing but a list of related products.

Thanks,
Sam

[DrByte]

Zen Cart doesn't specifically deny you the ability to use iframes. However, it's very common that server security tools, such as mod_security, will deny use of things like iframe tags because that's how hackers often add rogue content to sites.

Contact your hosting company and ask them to remove the security protections from your site if that's REALLY what you want to do.

[samhughey]

Thanks, that convinces me to not use them.

[Website Rob]

Actually, it should convince you not to use iFrames. There is no need for them except for very certain situations; of which an eCommerce Product Info page is not one of.

Perhaps if you described what it is you are trying to do, people will offer more correct coding to do what you want?

[stevesh]

I think I'll disagree with that. I can think of several legitimate reasons to use an iframe on the product info page, including assembly instruction videos and informational videos from Youtube.

[schoolboy]

Iframes are, in reality, a "clumsy" way of embedding data into a page, from an external source, and while I don't really like them, they are used in many instances - EG: even by Google (when you embed a MAP in your site you will use <iframe>).

It's more about WHERE and WHY you use them that matters.

In ZC, we use them exclusively on the define pages and EZ pages ONLY.

As DrByte says, IFRAME has a bad reputation.

And this is for two reasons:

1. Microsoft invented them
2. Hackers like them because they can "spoof" a website.

Payment gateway providers hate them for reason "2", and the rest of the world hates them for reason "1".

[vandiermen]

could be that HTMLeditor removes the closing tag of the iframe before perview and iframe don't work without closing tags and casue display problems / page crash

could try
edit: editors/htmlarea/htmlarea.js

find

HTMLArea.needsClosingTag = function(el) {
var closingTags = " head script style div span tr td tbody table em strong font a title ";
return (closingTags.indexOf(" " + el.tagName.toLowerCase() + " ") != -1);
}; 

(line 3893)

add iframe
e.g.:

HTMLArea.needsClosingTag = function(el) {
 var closingTags = " iframe head script style div span tr td tbody table em strong font a title ";
 return (closingTags.indexOf(" " + el.tagName.toLowerCase() + " ") != -1);
}; 

[kuroi]

Payment gateway providers hate them for reason "2"

Some payment gateway providers use them as it's a good way to collect card information straight to their servers without it ever being known to the store and therefore simplifies PCI compliance.

[Website Rob]

Perhaps it depends on who does the PCI scanning but TMK, iframes do not meet PCI Compliance. Using jQuery for a new Window is a much better alternative to iframes.

[schoolboy]

Some payment gateway providers use them as it's a good way to collect card information straight to their servers without it ever being known to the store and therefore simplifies PCI compliance.

Yes... SagePay is an example...

The difference is that THEY own the Iframe contents... not some stranger!