Menu
On my website, users will be able to input html tags for the content so the text can be bold, italic or links and image. I plan to use ckeditor or tinymce which are really using HTML tags (not BBC code or wiki syntax) If I allow HTML, when the text will be shown it will be interpreted and it may contain some "hack" like javascript or XSS.... How can I do to avoid this security issue ? Do I have to list the wanted html tags and to delete all unwanted tags and content ? Can I use strip tags for this ?
How is it done on stackoverflow for example ?
Do you know some plugin php/jquery plugins who can safely save and safely interpret limited html tags ?
Thanks in advance for your help
646
asked Jul 23 '26 08:07
You need to use both a server side HTML sanitizer, and a Content Security Policy preventing in-line scripts, eval and remotely hosted scripts
Depending on what language you are using server side, use HtmlSanitiser or python Bleach.
using either client side validation or naive filtering will not protect you at all:
str_replace('<script>', '', $str); suggested by @user1477388 will not protect you when someone uploads <script src="foo"> or <<script>script>alert('foo');</script> or <body onload="alert('foo')";</body>
131
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
