HTML encoding in codeiginiter

Question

I have an issue with the html-encoding in the Input library in Codeigniter.

I have a form used to edit the News in the admin side of my project. Here is the HTML code of the title of the news:
echo form_input('title',($title) ? $title : $this->input->post('title'));

When the edit page is loaded, I'm taking the news title and assigning it to $title.After editing, if any validation error occur, the form will be shown again with the posted value in title file. The above code is written with that in mind.

Now coming to the issue, suppose admin enters title as XYZ's survey report, and submits. Then if a validation error occurs for some other field, when the form is loaded, the title field shows

XYZ's survey report

I think in the Input class, the posted valued is html encoded. So my requirement is, if a validation error occurs, I have to html decode the value before showing it in the form.I have tried

echo form_input('title',($title) ? $title : html_entity_decode($this->input->post('title'),ENT_QUOTES));

and it works. But the project is big and has so many form fields. I would be disappointed to know this is the only way to achieve this.

Answer 1

The input class will encode automatically if you have XSS filtering enabled globally. Check your application/config/config.php file to make sure that it is turned off:

$config['global_xss_filtering'] = FALSE;

http://codeigniter.com/user_guide/libraries/input.html

Answer 2

XSS Filtering doesn't affect the displayed input field value.

I see two options:

1) You can manually create the INPUT element:
<input type="text" name="title" value="<?php echo ($title) ? $title : $this->input->post('title'); ?>" />

2) You can modify the CodeIgniter source code (not recommended - it is likely to create havoc later on).

PS: Here is the function that CodeIgniter is using when showing the form_input value (form_helper.php):

function form_prep($str = '')
{
 // if the field name is an array we do this recursively
 if (is_array($str))
 {
  foreach ($str as $key => $val)
  {
   $str[$key] = form_prep($val);
  }

  return $str;
 }

 if ($str === '')
 {
  return '';
 }

 $temp = '__TEMP_AMPERSANDS__';

 // Replace entities to temporary markers so that 
 // htmlspecialchars won't mess them up
 $str = preg_replace("/&#(\d+);/", "$temp\\1;", $str);
 $str = preg_replace("/&(\w+);/",  "$temp\\1;", $str);

 $str = htmlspecialchars($str);

 // In case htmlspecialchars misses these.
 $str = str_replace(array("'", '"'), array("'", """), $str);

 // Decode the temp markers back to entities
 $str = preg_replace("/$temp(\d+);/","&#\\1;",$str);
 $str = preg_replace("/$temp(\w+);/","&\\1;",$str);

 return $str;
}

As you see, the function is using htmlspecialchars and other tricks.

UPDATE- CodeIgniter exqample:

// config.php: $config['global_xss_filtering'] = FALSE;
echo form_open("test");
echo form_input('title', ($this->input->post('title')) ? $this->input->post('title') : $title);
echo form_input('title', ($this->input->post('title')) ? $this->input->post('title') : $title, FALSE);
echo form_input('title', ($_POST['title']) ? $_POST['title'] : $title, FALSE);
echo "<input type=\"text\" name=\"title\" value=\"" . (($title) ? $title : $this->input->post('title')) . "\" />";
echo form_submit("btn", "Submit");
echo form_close();

// output:
<form action="/test/" method="post">
<input type="text" name="title" value="XYZ&#39;s survey report"  />
<input type="text" name="title" value="XYZ&#39;s survey report"  />
<input type="text" name="title" value="XYZ&#39;s survey report"  />
<input type="text" name="title" value="XYZ's survey report" />
<input type="submit" name="btn" value="Submit"  />
</form>

Answer 3

I think it's because of the set_value() function (if you're using it when inserting the data into the database)