Best Practice: User generated HTML cleaning

Posted by Martin on Stack Overflow See other posts from Stack Overflow or by Martin
Published on 2010-05-05T14:26:22Z Indexed on 2010/05/05 14:38 UTC
Read the original article Hit count: 248

Filed under:

wysiwyg

|

php

|

html

|

JavaScript

|

cross-site-scripting

I'm coding a WYSIWYG editor width designMode="on" on a iframe. The editor works fine and i store the code as is in the database.

Before outputing the html i need to "clean" with php on the server-side to avoid cross-site-scripting and other scary things. Is there some sort of best practice on how to do this? What tags can be dangerous?

UPDATE: Typo fixed, it's What You See Is What You Get. Nothing new :)

© Stack Overflow or respective owner

Related posts about wysiwyg

jQuery + InnovaStudio WYSIWYG Editor

as seen on Stack Overflow - Search for 'Stack Overflow'
I am trying to avoid hard-coding each instance of this WYSIWYG editor so I am using jQuery to create an each() loop based on function name. Annoyingly InnovaStudio seems to explode when I try. Documentation Attempt #1 <script type="text/javascript"> /* id = $(this)… >>> More
Inserting Google Maps into a WYSIWYG editor, then saving and retrieving properly

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, I'm trying to extend jWysiwyg with an function to add a map from Google Maps. I can get the map all right, but I'm having problems with how to handle the generated map so it can be saved with the page and then retrieved. To open the process up a bit: User enters editor which is created using… >>> More
Copying Pasting Word 2007 docs to HTML WYSIWYG editors

as seen on Stack Overflow - Search for 'Stack Overflow'
Microsoft word has a ton of proprietary formatting and styles that do not translate well to html WYSIWYG editors. When you paste them over to the html editor and try to edit the pasted info it causes all kinds of clashing styles. I want to be able to keep the general structure but leave out the… >>> More
Using QT to build a WYSIWYG Editor for a Custom Markup Language

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm new to QT, and am trying to figure out the best means of creating a WYSIWYG editor widget for a custom markup language that displays simple text, images, and links. I need to be able to propagate changes from the WYSIWYG editor to the custom markup representation. As a concrete example of the… >>> More
embeding youtube video to content in wysiwyg editor

as seen on Stack Overflow - Search for 'Stack Overflow'
i have an editor that is basic microsoft actions: "createlink" "bold" etc. i made page to handle the youtube embeding and it works fine on the website. but in the editor all i can see is the rectangle of the video with nothing in it. the editor is an iframe editable that get the content from another… >>> More

Related posts about php

Magento, NGINX, PHP-FPM, APC, MEMCACHED, 16gb Ram CentOS, Spiking PHP-FPM to 100% CPU

as seen on Server Fault - Search for 'Server Fault'
I have been trying to resolve my issue of spiking cpu caused by php-fpm processes. I've reduced the php-fpm config settings to: pm = ondemand pm.max_children = 12 pm.start_servers = 2 pm.min_spare_servers = 2 pm.max_spare_servers = 10 pm.max_requests = 500 php_admin_value[memory_limit] = 128M Problem… >>> More
PHP Pear Installation on CentOS

as seen on Server Fault - Search for 'Server Fault'
[root@ip ~]# yum install php-pear* Reducing CentOS-5 Testing to included packages only Finished Setting up Install Process Package 1:php-pear-1.8.1-2.el5.centos.noarch already installed and latest versio … >>> More
Apache configurations for php "AddType text/html php" or "AddType application/x-httpd-php php .php"

as seen on Server Fault - Search for 'Server Fault'
I am taking over an application server and discover that it contain the following settings: AddType text/html php Although it works, but my understanding is that it should set as following: AddType application/x-httpd-php php .php What are the key differences between the two settings?… >>> More
mod_rewrite settings causes server to throw HTTP 500 errors instead of 404

as seen on Server Fault - Search for 'Server Fault'
Hello. I have a server with VBulletin forum (working under Apache 2.2, CentOS). The default settings for it in .htaccess are as follows: RewriteEngine on RewriteCond %{HTTP_HOST} ^gsmforum\.ru RewriteRule (.*) http://www.gsmforum.ru/$1 [R=301,L] # If you are having problems or are using VirtualDocumentRoot… >>> More
Problems installing Memcache (PECL extension)

as seen on Server Fault - Search for 'Server Fault'
I have installed memcached fine, and now I will need to install PECL extension memcache. Im running RedHat x86_64 es5. The installation gives me this: downloading memcache-2.2.6.tgz ... Starting to download memcache-2.2.6.tgz (35,957 bytes) ..........done: 35,957 bytes 11 source files, building running:… >>> More