[Resolved] CSS data pulled from a mysql table

Tad

Okay, I created member profiles for people that use my site. What I want to allow them to do is enter in custom CSS in order to change the colours and positioning of their profiles (like ezBoard's if you're familiar with those).

I'm just wondering if there are any dangers I should be aware of, or particular tags that should be stripped...? Pretty much all I'm going to have it do is if it detects that custom CSS has been entered, it won't include the default CSS file, and just print out the custom CSS instead.

thorpe

i wouldnt think there is too much to worry about here. anything that a client does code will only effect there session right?

this way, if they stuff up the css, they only stuff it for themselves. also if they write any javascript in here, it will only effect them.

i would however, be more inclined to trun this all into a form. dont let the clients define new css elements, just let them change the values of elements.

you might also need to create a way for them to undo there css. remembering, that if they stuff there css well enough, they wont be able to see your site.

ShawnK

What you should do is create a table users_css or whatever you want to call it, and then make a column for each tag you want to allow, then make a page in their profile where they can edit specific values, then validate them. Just so you don't have #00000 as a link, etc. This would be much safer then allowing them to put whatever they want.

You could implement w3.org's CSS validator... :p

Tad

Hm, I was thinking of making the CSS variables customizable using a form. It's just that I have so many different variables, and I want them to also be able to position the div layers that I've created as well, not just limit them to changing colours/font sizes.

Great suggestions though. I'm going to see where I can take it from here. 🙂

thorpe

they could still change positions, colors, everything.

id'e still be a little worried. i mean, if they stuff there css, they may not be able to view your site.

Tad

Oh, I'm not too worried about that. 🙂 The page where they're going to be editing their css from isn't going to be pulling their pulling thier custom inputs, so it should be relatively safe.