Home/ Questions/Q 179585
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T14:25:58+00:00

I developed a web application, that permits my users to manage some aspects of

  • 0

I developed a web application, that permits my users to manage some aspects of a web site dynamically (yes, some kind of cms) in LAMP environment (debian, apache, php, mysql)

Well, for example, they create a news in their private area on my server, then this is published on their website via a cURL request (or by ajax).

The news is created with an WYSIWYG editor (fck at moment, probably tinyMCE in the next future).

So, i can’t disallow the html tags, but how can i be safe? What kind of tags i MUST delete (javascripts?)? That in meaning to be server-safe.. but how to be ‘legally’ safe? If an user use my application to make xss, can i be have some legal troubles?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. If you are using php, an excellent solution is to use HTMLPurifier. It has many options to filter out bad stuff, and as a side effect, guarantees well formed html output. I use it to view spam which can be a hostile environment.

    • 0