Board Thread:Support Requests - Getting Technical/@comment-4356266-20150831135417/@comment-4018164-20150831180418

Shining-Armor wrote: Penguin-Pal wrote: Well, i have 0.00000 experience with Lua, but since the returned output of modules is parsed as wikitext, it will be treated just as if you were to write the output manually in an ordinary page. Since the  is not a valid MediaWiki tag, it is parsed like an ordinary text. Since its SRC attribute has a valid URL, that URL is the only thing that is parsed not as an ordinary text, and therefore turns into a link.

If you really want to embed an iframe, while still using a Lua module, you should make your module output a  element with   attribute set to the wanted URL, and then let JavaScript to repalce the span with an iframe. For instance:

It is easy to get JavaScript wrong and allow users to abuse the code, but the above example is safe to use.

However, since wikia still (cough cough, cough cough) hasn't enabled JS editing back, there's no point in implementing it for now.

As for your Utility module question, i'm afraid i don't have the experience or knowledge to answer it, though i hope i helped a bit with your first one. Whenever you are adding something directly to a page via JS you should always use  to make sure everything is properly escaped. Oh, i was unaware of this function. Though the upper code only executes if the query string contains only a-z letters or digits, which shouldn't allow people to mess the code with disguised inline events or stuff like that.