Home/ Questions/Q 7863049
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-02T23:21:14+00:00

For example I have a Javascript-powered form creation tool. You use links to add

  • 0

For example I have a Javascript-powered form creation tool. You use links to add html blocks of elements (like input fields) and TinyMCE to edit the text. These are saved via an autosave function that does an AJAX call in the background on specific events.

The save function being called does the database protection, but I’m wondering if a user can manipulate the DOM to add anything he wants(like custom HTML, or an unwanted script).

How safe is this, if at all?

First thing that comes to mind is that I should probably search for, and remove any inline javascript from the received html code.

Using PHP, JQuery, Ajax.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Not safe at all. You can never trust the client. It’s easy even for a novice to modify DOM on the client side (just install Firebug for Firefox, for example).

    While it’s fine to accept HTML from the client, make sure you validate and sanitize it properly with PHP on the server side.

    • 0