Home/ Questions/Q 8647321
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-12T13:02:31+00:00

In my CakePHP blog, I want to enable users to make similar HTML additions

  • 0

In my CakePHP blog, I want to enable users to make similar HTML additions as you can insert here on StackOverflow, i.e. line breaks, links, bold, lists etc. But I am a little unsure how I shall tackle this issue in terms of what is most practical whilst maintaining protection against malicious code in the posts users submit.

  • Practically is it the most convenient to save the post in a TEXT database field and allow some HTML in that?
  • If I allow some HTML code in the post, how do I ensure that I only allow non-malicious basic HTML code whilst cleaning out the rest?
  • Should I be using the CakePHP Sanitize class for that somehow?
  • Will the FormHelper clean out all HTML users input?
  • I assume I’ll have to use JavaScript to help users generate the right code?
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If it’s not for developers, have you considered a WYSIWYG addon like TinyMCE?

    http://www.tinymce.com/

    http://bakery.cakephp.org/articles/galitul/2012/04/11/helper_tinymce_for_cakephp_2

    As for security, whitelisting is the safest method. Blacklisting should be avoided because there’s no way you can handle all the tricks that can be used to bypass them (e.g. passing in text via hex, etc).

    TinyMCE lets you specify a whitelist:
    http://www.tinymce.com/wiki.php/Configuration:valid_elements

    • 0