How do I "safely" allow html code to be posted ?

[habbardone]

Hi,

I am writing a script which allows clients to build a page on my server using
a simple input form.

The main text input is a text blob set up in the database table as:

page_body text NOT NULL,

My input form contains this to allow input :

<textarea id="TheTextArea" class="data1" rows="24" cols="80" name="x_counted2"><?php echo $N_page_body ?></textarea>

And I process that input with:

function safe_sql( $value ){
     $value = strip_tags(trim($value));

// Stripslashes
	if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc())  {
    $value = stripslashes($value);
}
// Quote if not integer
if (!is_numeric($value)) {
    $value = mysql_real_escape_string($value);
}
return $value;
} // End of Function


$N_page_body = $_POST['x_counted2'];
$Db_page_body	= safe_sql($N_page_body);

$sql = "UPDATE `client_pages` SET page_body	= '$Db_page_body' WHERE ..."

The code I want to allow to be posted is an autoresponder
code:

<!-- Express Response Plugin Begin -->
<span style="font-size:14px;font-weight:bold;color:black;">
<center>Pick Up Our Free Newsletter</center></span>
<form name="regis"action="http://expressresponse.net/leads.php" 
method="POST"><span><input type="hidden" name="xrkey" 
value="gs44s9023d8957z44ej"></span><span><b>Name:</b>
</span><span><INPUT name="x_name" value='' size="20" 
maxlength="30" type="text"></span><br><span>
<b>Email:</b></span><span><INPUT name="x_email" 
value='' size='20' maxlength='60' type='text'></span>
<br><br><center><input type='submit' value='SUBSCRIBE'>
</center><span style="font-size:6x;"><br>
<a href="http://www.expressresponse.net">
Free Autoresponder Plugin</a></span></form><br>
<!-- Express Response Plugin End -->

But when this is pasted into my input form, the resulting
data held in my table is this:

Pick Up Our Free Newsletter
Name:

Email:

Free Autoresponder Plugin

All the important stuff was stripped out.

When I use wordpress, there are "widget" areas which allow this
type of code to be pasted in.

Does anyone know how I can allow this code to be pasted in while still
keeping my database safe ?

Thanks.

.

[dalecosp]

Most of these tools do some encoding of the HTML first, often by converting the HTML entities, which can then be reversed when the code comes back out of the database. You might trying looking at [man]htmlentities[/man] and [man]html_entity_decode[/man] and see if you can make this magic happen 🙂

(I don't know I've ever done this, but I've worked with a good bit of software that does; some of it not so well, in fact). Good luck!

[traq]

this:
. [font=monospace] $value = strip_tags(trim($value));[/font]
has nothing to do with making the input "safe for the database."
html can be saved in a database with no special problems (i.e., you still have to use mysql_real_escape_string(), but nothing more). if you remove this line, or make it optional, you'll be able to use this function to without removing the HTML.

example:

<?php
function safe_sql_with_optional_HTML( $value,$HTML=FALSE ){

// if you pass TRUE as the second parameter,
//    the function will skip the strip_tags() part,
//    and leave the HTML markup intact.
// this will not affect other code that uses this function,
//    since the default is still to strip the HTML out.
if( !$HTML ){
     $value = strip_tags(trim($value));
}

    if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc())  {
    $value = stripslashes($value);
}
if (!is_numeric($value)) {
    $value = mysql_real_escape_string($value);
}
return $value;
}

Now, before you automatically print anything, you have to remember that there might be HTML markup in your database.

If you've done nothing to make sure the markup is valid and non-malicious, then you might end up with security problems.

At the very least, you should limit the ability to post html to a certain subset of tags (e.g., no javascript or iframes) and/or to a limited subset of users (i.e., the ones you trust).

If you aren't sure, you should use [man]strip_tags/man to remove the HTML when you print it.

You might also look into using BBCode as a way of allowing only certain HTML elements to be included.

[habbardone]

Thanks very much for your replies.

The code is immediately displayable by the user so:

If you aren't sure, you should use strip_tags() to remove the HTML when you print it.

This would have the same effect as stripping the tags before saving to database.

You might also look into using BBCode as a way of allowing only certain HTML elements to be included.

Yes I am using this - actually it my setup looks a bit tile this forum input form.

So I have buttons that put square brackets around the text and then my after retreival from the databases my bbcode.php does a lot of preg_replace before the it is output and filtered by the bbcode.css

But I really wanted to allow the user to just paste in the autoresponder form code as is.

Hmm ...

any more ideas ?

Thanks again.

.

[traq]

habbardone;10998458 wrote:

This would have the same effect as stripping the tags before saving to database.

The <tags> would be removed, yes - but there are two major advantages:

1. You still have the original user submission. What if you decide later on to do something different? What if you need to display the text with HTML in one situation, and without in another? What if you want to allow the user to edit their submission? Even using BBCode, you still need to save the original submission to accomplish these things.

2. You know you're doing it. When you hide these processes away, in essentially unrelated functions, you stop thinking about them. You don't understand what's going on. You are far more likely to have confusing, unforeseen problems when you don't know exactly what's going on in the first place. So, as a rule, making these accommodations "at the last minute" is A Good Thing. Only strip out stuff you know you're never going to use.

habbardone;10998458 wrote:

But I really wanted to allow the user to just paste in the autoresponder form code as is.

(Selectively) Validating HTML is very, very complex and error-prone. Allowing one sort of tag - but not others - is easy enough, but arbitrary filtering gets more and more difficult, especially since browsers handle things differently and are constantly changing as well. (Your example includes attributes in your HTML tags, which complicates things even further. What's to stop someone from typing [font=monospace]<span style="font-size: 6px" onclick="badStuff();">[/font]?) You will always have a trade-off between security and allowing users to submit HTML.

[habbardone]

Thanks for your help.

You said:

Even using BBCode, you still need to save the original submission to accomplish these things.

Actually you only save the bbcodes.

So you save :

[b] instead of <b>

You then translate it

from [b] to <b>

in order to display.

Still not sure of the best solution on this. :bemused:

.

[traq]

Right - that's what I meant. Sorry if I was unclear.

Are you using the BBCode extension? or just [man]preg_replace/man?

If it's the former, you can add custom tags. If it's for just a small snippet like the one you posted (you'd only need to add [form] and [span], really), that may not be too difficult. (I've never tried it myself, so let me know how it goes!)

If it's the latter, you might have a harder time of it, but it could still be done.

I think it would be better to find an alternative solution, however. Turning the form markup into a template, for example, and having the users submit the required values so your script can construct the form itself. It would be far more reliable.

[habbardone]

I am using preg_replace() because I have a small set
and I wanted to have control over what was going on.

Assuming this is the plugin code:

<!-- Express Response Plugin Begin -->
<span style="font-size:14px;font-weight:bold;color:black;">
<center>Pick Up Our Free Newsletter</center></span>
<form name="regis"action="http://expressresponse.net/leads.php" 
method="POST"><span><input type="hidden" name="xrkey" 
value="gs44s9023d8957z44ej"></span><span><b>Name:</b>
</span><span><INPUT name="x_name" value='' size="20" 
maxlength="30" type="text"></span><br><span>
<b>Email:</b></span><span><INPUT name="x_email" 
value='' size='20' maxlength='60' type='text'></span>
<br><br><center><input type='submit' value='SUBSCRIBE'>
</center><span style="font-size:6x;"><br>
<a href="http://www.expressresponse.net">
Free Autoresponder Plugin</a></span></form><br>
<!-- Express Response Plugin End -->

I am thinking of creating a new bbcode:

[autoresp]gs44s9023d8957z44ej [/autoresp]

And then use my bbcode.php to preg_replace() and re-build the form.
Maybe I need a container for it with a width, so it could be:

[autoresp]gs44s9023d8957z44ej,200 [/autoresp]

And then I can create:

<div style="float:left; width:200px">
<form name="regis"action="http://expressresponse.net/leads.php" 
method="POST"><span><input type="hidden" name="xrkey" 
value="gs44s9023d8957z44ej"></span><span><b>Name:</b>
</span><span><INPUT name="x_name" value='' size="20" 
maxlength="30" type="text"></span><br><span>
<b>Email:</b></span><span><INPUT name="x_email" 
value='' size='20' maxlength='60' type='text'></span>
<br><br><center><input type='submit' value='SUBSCRIBE'>
</center><span style="font-size:6x;"><br>
<a href="http://www.expressresponse.net">
Free Autoresponder Plugin</a></span></form>
</div>

That will leave the user free to add their own heading in whatever style
they want.

Only downside to this method is that the input sizes and layout are fixed.

I could add a "float option" and "font size" as well:

[autoresp]gs44s9023d8957z44ej,left, 200,12 [/autoresp]

But this may be the best method.

Any thoughts ?

.

[traq]

Keep it simple. Unless the layout options are -essential-, they'll just be confusing. Just copy+paste something like

[autoresp]gs44s9023d8957z44ej [/autoresp]

seems ideal.