Home/ Questions/Q 6241939
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-24T11:51:32+00:00

i have a textarea and I am using ckeditor to allow users to enter

  • 0

i have a textarea and I am using ckeditor to allow users to enter data and click upload. This will save the html of this data to a mysql database table to display on a separate web page

What do i need to worry about in terms of what people are posting. Do i need to add any validation on the front end or back end to ensure that they are not posting dangerous scripts, etc . .

What is the easiest way to validate that what is being posted is fine to store and put back to the client to display later.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Do i need to add any validation on the front end or back end to ensure
    that they are not posting dangerous scripts, etc

    No, you shouldn’t worry about this. As far as you use parametrized queries in order to store data to avoid SQL injection a relational database doesn’t care much about what kind of text you are throwing at it.

    Problems might arise when you try to display this data back on a web page. It is at this moment that you should ensure that it is properly HTML encoded.

    For razor:

    @...

    For WebForms (ASP.NET 4.0)

    <%: ...

    For WebForms (prior to ASP.NET 4.0)

    <%= Html.Encode(...

    Or for all of the above:

    Html.DisplayFor(x => x.SomePropertyOftheViewModel)

    What is the easiest way to validate that what is being posted is fine
    to store and put back to the client to display later.

    Parametrized queries to store data (only if you are using a relational database) and HTML encode to display back.

    You might also find the following blog post useful about the Microsoft Anti-Xss library.

    • 0