CakePHP: How can i stop inserting/adding html tag during commenting of a post?

Question

This is the form for comment:

echo $this->Form->create('Comment',array('url'=>array('controller' => 'comments', 'action' =>'add', $listposts['Post']['id']) ) ); echo $this->Form->input('post_id',array('type'=>'hidden','style'=>'width:30%','value'=>$listposts['Post']['id'])); echo $this->Form->input('name',array('style'=>'width:30%')); echo $this->Form->input('email',array('style'=>'width:30%')); echo $this->Form->input('body',array('rows'=>'5')); echo $this->Form->end('Comment');

The comment.php model =>

var $useTable='comments'; var $belongsTo = array('Post'); var $validate = array( 'name' => array( 'required' => true, 'rule' => 'notEmpty', 'allowEmpty' => false, 'message' => 'Enter Name.' ), 'email' => array( 'required' => true, 'rule' => 'notEmpty', 'allowEmpty' => false, 'message' => 'Enter Email.' ), 'body' => array( 'required' => true, 'rule' => 'notEmpty', 'allowEmpty' => false, 'message' => 'Enter Body.' ) );

}

But during commenting someone can type in any textbox of the comment form like this =>

<script> alert("Hello world"); </script>

Then this alert will be displayed during the page load. How can i stop inserting this html tags in database ? How can i check this html block ?

deceze · Accepted Answer · 2011-10-02 04:21:30Z

There are two ways to handle this: sanitizing or escaping the string. Sanitizing means you strip all unwanted content out. Escaping means you "disable" any special characters in the string. You should always escape user-supplied content when outputting it:

echo htmlspecialchars($comment['body']);

Optionally you may want to sanitize the string, but that can be tricky. Look into Cake's Sanitize class. The Great Escapism is also apropos.

Should i remove tags before saving data from form fields ? Or should i use strip_tags() before echoing strings ?
@guru Depends. I prefer to store any input in its original form and alter it during output only. You will never get the original back if you discard information immediately. It's really up to you and your priorities though.

tttony · Accepted Answer · 2011-10-02 04:23:57Z

You can use: strip_tags() or htmlspecialchars()

$str = "<script>alert('Hello world');</script>"; echo "strip_tags = " . strip_tags($str); echo "htmlspecialchars = " . htmlspecialchars($str);

Demo

Should i remove tags before saving data from form fields ? Or should i use strip_tags() before echoing strings ?

mowwwalker · Accepted Answer · 2011-10-02 04:20:22Z

0

Use this:

http://php.net/manual/en/function.htmlspecialchars.php

answered Oct 2, 2011 at 4:20

mowwwalker

17.5k30 gold badges109 silver badges166 bronze badges

Collectives™ on Stack Overflow

CakePHP: How can i stop inserting/adding html tag during commenting of a post?

3 Answers 3

2 Comments

1 Comment

Comments

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

1 Comment

Comments

Related