Home/ Questions/Q 950145
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-15T23:31:13+00:00

I have a page with two textareas, where registered users can fill them with

  • 0

I have a page with two textareas, where registered users can fill them with HTML codes. First one has TinyMCE (so HTML is cleaned up), but the other one does not, since I expect the code to be inserted as embed codes from other sites (mostly sites that provide maps, e.g. Google Maps, MapMyRace.com, etc). But problem is that those other sites may provide different tags, not just <embed> or <iframe>. So I can’t strip tags because then I might strip tags that I didn’t know other sites provided. I will save the HTML in these two textareas into my database, to be retrieved and displayed as parts of some other pages.

Do you have any suggestions to make this setup more secure? Or should I disallow free input of HTML in the 2nd textarea altogether? (Or.. I let the users tick a check box saying “I accept full responsibility for the behavior of the code I am inserting”.. LOL)

Your opinion is highly appreciated 🙂

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The short answer is : free HTML is insecure and must be avoided. Nothing blocks your user from creating an iframe that redirects the user to some harmful page or put ads on your page or deface your site.

    My favorite approach to this problem is to allow the user to paste a link (no the “embed on page” iframe code) in a text box. Then I use regex to identify the pasted link (is it youtube, Bing maps, …) and I create the HTML from the pasted link, which isn’t too complex for most iframe providers. It’s much more work for you, and it restricts the APIs you can put on your page, but it’s secure.

    • 0