CODEWITHSUNDEEP
javascriptsecurityckeditor
Nathan H
Nathan H

Reputation: 49371

Is CKeditor safe for letting end-users submit content?

I am about to let some users publish articles on my site.

To make it easier for them, I was thinking of using a CKeditor, let them have links, images, formating, etc ...

However I was thinking of javascript. Can someone inject javascript or will CKeditor clean it up? Do I need my own filtering?

Upvotes: 2

Views: 1031

Answers (1)

Lekensteyn
Lekensteyn

Reputation: 66405

Content submitted by the user should always be checked, even if an application like CKeditor generates valid code. You can use HTMLPurifier for serverside sanitizing.

Upvotes: 5

Related Questions