A
A
asdasdqwe2021-12-11 13:38:23
PHP
asdasdqwe, 2021-12-11 13:38:23

How to save text with tags in the database and display?

The user enters < b>hello b> - Save in the database as is

If output like this:
echo $text; //We see hello

But this is not safe, the user can enter a js script (xss attack)

If we escape:
echo htmlspecialchars($text ) //We see plain text as is < b>hello b>

How to make it so that the user can enter text with tags (create tables, text boldness, etc.), but cannot create anything else (scipt. input. select), etc.

For example, as in habr, I can change text boldness, italics, create a list - BUT <script> can't

Answer the question

In order to leave comments, you need to log in

1 answer(s)
F
FanatPHP, 2021-12-11
@asdasdqwe

htmlpurifier but it would be a million times better to use normal markdown instead of moronic html

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question