Home/ Questions/Q 8978159
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-15T19:32:34+00:00

I´m using htmlPurifier to prevent XSS Attacks from users and everything works ok on

  • 0

I´m using htmlPurifier to prevent XSS Attacks from users and everything works ok on input type=”text” fields. But, when i try to clean tinyMCE textareas seems like htmlPurifier don´t work, ex.:

Simple input text field

Input.: 

<script>alert("XSS")</script>Cleaning Test

Output: Cleaning Test

tinyMCE TEXTAREA

Input.:

<script>alert("XSS")</script>

Output: <script>alert("XSS")</script>

Did i miss something ? Why htmlPurifier work on a simple input text and with tinyMCE textarea don´t ?

Ps.: Magic Quotes are Off

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I think i found what was wrong.

    tinyMCE automatically encode entities such:

    < into &lt;
> into &gt;
" into &quot;
& into &amp;

    I tried to use diferent types of entity_encoding on tinyMCE but none of them seems to work as i want, so i used PHP: html_entity_decode to decode tinyMCE text area and then i used htmlPurifier to sanitize the data and everything works ok now.

    Hope someone else find this usefull.

    • 0