Which is the best way of correct filter for HTML editor in PHP?

Question

I'm using TinyMCE editor in my site. I want to learn way of correct filter for my input when i'm inserting to DB. Which filters are need to use? For example i get this input to DB this way;

$example = $_POST['example'];

<textarea name="example"></textarea>

I'm not using htmlscepialchars(); because i need the html tags.

"Sorry for my poor English."

Answer 1

you can use strip_tags

and add array of allowed tags only the tags you want to remain.

http://php.net/manual/en/function.strip-tags.php like

// Allow <-p-> and <-a-> tags

strip_tags($text, '<p><a>');

Answer 2

If I understand correctly, you want to save html to your database, and need some way to encode it?

You could do the following before saving to the db:

urlencode($_POST['example']);

And when you retrieve, you can urldecode($data);

Answer 3

PHP has a very nice filter Function http://php.net/manual/de/ref.filter.php

That's assuming you are using MySQL as database.

/*** use a callback filter to mysql_real_escape_string ***/
$example = filter_input(INPUT_POST, "example", FILTER_CALLBACK, array("options"=>"mysql_real_escape_string"));

$sql = "INSERT INTO content (example) VALUES ('{$example}')";

/*** echo the query ***/
echo $sql;

You can aswell just escape your POST field (if u dont want to use the above method):

*Side Note: In short mysql_real_escape_string() escapes data, it doesn't sanitize it -- escaping and sanitizing aren't the same thing.*

$example = mysql_real_escape_string(stripslashes($_POST['example']));

Or you can go for Prepared statements which is the best option i belive mysqli

Answer 4

HTMLPurifier.

Download it here: http://htmlpurifier.org/

Include it:

include 'path/to/HTMLPurifier.auto.php';

Use it:

$config = HTMLPurifier_Config::createDefault();
$config->set('Core', 'Encoding', 'UTF-8');
$config->set('XHTML', 'Doctype', 'XHTML 1.0 Strict');
$purifier = new HTMLPurifier($config);
$clean_html = $purifier->purify( $dirty_html );

And sleep well knowing there are no XSS attacks in HTML cleaned like this.

People suggesting mysql_real_escape_string() probably didn't get your question (or i didn't), you were asking how to filter HTML markup from a WYSIWYG editor so it can be safely stored in a database.

mysql_real_escape_string() is relevant as a protection against SQL injection but prepared statements (google "PDO") are better for that.