Organizational Research By

Surprising Reserch Topic

tinymce security question how do you prevent malicious input


tinymce security question how do you prevent malicious input  using -'php,javascript,security,codeigniter,tinymce'

How do you prevent malicious input in WYSIWYG editors like TinyMCE?

I have a system with users who are not "tech savvy" (so no WMD) and need a rich text editor that posts its content into a database.

I'm worried about scripting attacks and malicious input code.
    

asked Sep 15, 2015 by RexBeaulieun
0 votes
13 views



Related Hot Questions

2 Answers

0 votes

If you only want safe html then you should use the HTML Purifier. If you want to protect against XSS and block all html then you should use $var=htmlspcialchars($var,ENT_QUOTES);

answered Sep 15, 2015 by DusWhatley
0 votes

You can't prevent that input from the client side. You can add things to get in the way (or try), but it will always be trivial to submit malicious code. You NEED to sanitize in PHP.

ALWAYS ALWAYS ALWAYS escape user submitted content before displaying it (htmlentities will usually take care of that for you).

If you want the ability to have HTML submitted (as you say you want WYSIWYG), then you'll need to white-list sanitize the HTML that was submitted. When I say white-list, I mean both tag name and attribute.

I'm not that familiar with CodeIgniter, but I did find this which looks like it may do what you want...

answered Sep 15, 2015 by AguedaTroutm

...