CODEWITHSUNDEEP
javascriptjqueryhtmllaravel-5
kakon
kakon

Reputation: 721

Handle Html tags in input area

Need to allow/disallow some certain html tags in js side. Developing a laravel project where in some input box need to consider certain html elements.

Can be done using string replace function but will take much more time to maintain the list of not allowable items.like the following

function escapeHtml(unsafe) {
    return unsafe
         .replace(/&/g, "&")
         .replace(/</g, "&lt;")
         .replace(/>/g, "&gt;")
         .replace(/"/g, "&quot;")
         .replace(/'/g, "&#039;");
 }

Again the allowed html tag list can also be small so if just want to allow
then the unsafe list will be huge.

I can also do it in server side but cant get any proper source for that.

It will be so helpful if someone can just suggest me what would be the best way for maintaining this allow/disallow html tag list?

Upvotes: 0

Views: 346

Answers (2)

kakon
kakon

Reputation: 721

So finally what i decided is using htmlpurifier

https://github.com/mewebstudio/purifier

So in server side we can customize which page will allow which tag using this

Upvotes: 0

Alexei Darmin
Alexei Darmin

Reputation: 2129

Never use clientside JS to escape anything. Adversaries can easily block the execution of your JS file and bypass it.

Server side prepared statements are industry standard for what you want.

Prepared statements treat user inputs as non-executable strings that have no effect on any queries you make using these inputs (ie SQL Injections).

Upvotes: 1

Related Questions