Question

I have a small issue implementing TinyMCE into a Symfony project. I get the text editor to come up and save rich text to a database field. But when I go to “echo” it on a page, I get all the HTML tags instead of the rich text itself. Is there a special way that I need to “echo” this so that it parses the html? I also want it so that when people manually type in html tags, that they are displayed as regular text (to avoid people people adding hyperlinks and other unwanted things to their posts). Here is what displays:

<p>Test</p> <p><strong>Bold Test</strong></p> <p><span style="text-decoration: underline;"><strong>Underline Text</strong></span></p>

Instead of this:

Test

Bold Test

Underline Text

Answer 1

Symfony2 uses output escaping for security. You can read about it here: http://symfony.com/doc/current/book/templating.html#output-escaping

To echo a variable without escaping it you can do this:

{{ article.body|raw }}

In order to clean up and restrict which tags can be used you will want to use HTMLPurifier which has a bundle here: https://github.com/Exercise/HTMLPurifierBundle

For Symfony 1.4

Symfony 1.4 has similar output escaping. You can get the raw data with:

$sf_data->getRaw('varName');

or if it’s a method on an object you can add ESC_RAW as a parameter to the method call (warning: symfony will do some magic here)

$myObject->getMessage(ESC_RAW);

more on 1.4 output escaping here