3

I have done a commenting system based on entries. It works fine but I would like to allow to registered users to do basic formatting on their comments. What type of checking is done on the Rich Text Field? Is it protected by SQL Injection or XSS?

1

All data that goes to the database is properly parameterized by Craft / Yii and ultimately PDO to prevent against SQL Injection attacks.

For obvious reasons, the Rich Text Field is the only field type that Craft will return the "raw" content for, meaning exactly what was saved in the database. All other field types will get automatically encoded by Twig on output.

If you're accepting guest input from a Rich Text Field on the front-end, you'll probably want to have it post to a plugin and run it through CHtmlPurifier to remove any malicious looking bits before getting saved to the database.

$purifier = new \CHtmlPurifier();
$purifier->purify($html)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy