TinyMCE security question: How do you prevent malicious input?

Question

How do you prevent malicious input in WYSIWYG editors like TinyMCE?

I have a system with users who are not "tech savvy" (so no WMD) and need a rich text editor that posts its content into a database.

I'm worried about scripting attacks and malicious input code.

Answer 1

Use JQuery Validation Plugin

Answer 2

You can't prevent that input from the client side. You can add things to get in the way (or try), but it will always be trivial to submit malicious code. You NEED to sanitize in PHP.

ALWAYS ALWAYS ALWAYS escape user submitted content before displaying it (htmlentities will usually take care of that for you).

If you want the ability to have HTML submitted (as you say you want WYSIWYG), then you'll need to white-list sanitize the HTML that was submitted. When I say white-list, I mean both tag name and attribute.

I'm not that familiar with CodeIgniter, but I did find this which looks like it may do what you want...

Answer 3

If you only want safe html then you should use the HTML Purifier. If you want to protect against XSS and block all html then you should use $var=htmlspcialchars($var,ENT_QUOTES);