Question

HI guys,

I building an app using CodeIgniter and I came to a problem. I have a form with a textarea in which the user puts his text using a simple editor powered by jwysiwyg.jquery. The problem is that is need to clean this input of garbage code (link the one that comes with pasting directly from Word).

The form is validated with the form_validation library from CodeIgniter, with this rule:

array(
 'field' => 'job[description]',
 'label' => 'Description',
 'rules' => 'trim|required|callback_clean_html'
),

Then I have a clean_html method that simply does a:

return strip_tags($text,'<a><p><br><strong><em><h3><h4><h5><ul><ol><li>');

The problem is that this is simply ignored and the original text gets inserted in the database. The method runs (I’ve tested). I asume it’s because a callback should return TRUE or FALSE, but then xss_clean doesn’t return a BOOL. The documentation isn’t much help.

Any thoughs?

Thanks in advance.

Answer 1

I think form_validation callbacks do need to return a bool. I find that form_validation is most useful when you need to display an error message to a user usually to resubmit the form. Although the prepping functions can be convenient, they don’t need to be there to validate. Why not pass the submitted string through the strip_tags function after the form is submitted but before you send it to your db?