Clever Geek Handbook

With tinymce, do you need to handle html markup?

If you are using tinymce, does that mean you should handle HTML parsing on postback (while storing data in db)?

i.e. do you need to parse the output and make sure the hacky script was sent back or can you make tinymce convert the html to safe markup?

+2


source to share


3 answers


You can never rely on a client to ensure that the content they host on your server is safe.

It's too easy for a potential attacker to disable these client-side measures and submit any dangerous content they want.



Therefore, you always need to validate your content on the server side, no matter which editor you are using in the browser.

+2


source


Yes, always !!! Consider whether to turn off the editor or not turn on javascript.



0


source


We use "valid element" checking to make sure that we only get standard HTML from the editor. No scripting, no events on attached tags (like anchor tags with onclick events). Just boring, plain HTML.

http://wiki.moxiecode.com/index.php/TinyMCE:Configuration/valid_elements

0


source






More articles:


All Articles