Clean html input in Codeigniter

Question

HI guys,

I building an app using CodeIgniter and I came to a problem. I have a form with a textarea in which the user puts his text using a simple editor powered by jwysiwyg.jquery. The problem is that is need to clean this input of garbage code (link the one that comes with pasting directly from Word).

The form is validated with the form_validation library from CodeIgniter, with this rule:

array(
 'field' => 'job[description]',
 'label' => 'Description',
 'rules' => 'trim|required|callback_clean_html'
),

Then I have a clean_html method that simply does a:

return strip_tags($text,'<a><p><br><strong><em><h3><h4><h5><ul><ol><li>');

The problem is that this is simply ignored and the original text gets inserted in the database. The method runs (I've tested). I asume it's because a callback should return TRUE or FALSE, but then xss_clean doesn't return a BOOL. The documentation isn't much help.

Any thoughs?

Thanks in advance.

Answer 1

Have you tried removing callback_ in the rule? You can do regular PHP functions like trim so this should work.

Answer 2

Something aI always do just to be double safe, after setting the rules for the input I also run them through this

`$string = filter_var($string, FILTER_SANITIZE_STRING);`

That will strip out the html

I too have run into situations lately where the input totally ignores the rules that have been set.

Answer 3

I think form_validation callbacks do need to return a bool. I find that form_validation is most useful when you need to display an error message to a user usually to resubmit the form. Although the prepping functions can be convenient, they don't need to be there to validate. Why not pass the submitted string through the strip_tags function after the form is submitted but before you send it to your db?

Answer 4

xss_clean and other CI validation functions return non-bool values. I just tested the following callback function in CI version 1.7.2:

function test_string_change($str)
{
    return "$str **";
}

The string was changed successfully using callback_test_string_change. I know there were some issues with the callback functions in 1.7.0, are you using the latest version?

Answer 5

Hello,

see weakness of codeigniter input library on http://newdailyblog.blogspot.com/2010/07/weakness-of-codeigniter-input-library.html.

Answer 6

Hello,

and see how you can fix it with an extended my input library on http://newdailyblog.blogspot.com/2010/07/documentation-of-codeigniter-my-input.html.