using htmlpurifier for input or output escaping/filtering

Posted by user214545 on Stack Overflow See other posts from Stack Overflow or by user214545
Published on 2010-05-24T13:54:58Z Indexed on 2010/05/24 14:01 UTC
Read the original article Hit count: 457

Filed under:

php

|

filtering

|

input-output

|

htmlpurifier

I am processing a user input from the public with a javascript WYSIWYG editor and I'm planning on using htmlpurifier to cleanse the text.

I thought it would be enough to use htmlpurifier on the input, stored the cleaned input in the database,and then output it without further escaping/filtering. But I've heard other opinions that you should always escape the output.

Can someone explain why I should need to cleans the output if I'm already cleaning the input?

© Stack Overflow or respective owner

Related posts about php

Magento, NGINX, PHP-FPM, APC, MEMCACHED, 16gb Ram CentOS, Spiking PHP-FPM to 100% CPU

as seen on Server Fault - Search for 'Server Fault'
I have been trying to resolve my issue of spiking cpu caused by php-fpm processes. I've reduced the php-fpm config settings to: pm = ondemand pm.max_children = 12 pm.start_servers = 2 pm.min_spare_servers = 2 pm.max_spare_servers = 10 pm.max_requests = 500 php_admin_value[memory_limit] = 128M Problem… >>> More
PHP Pear Installation on CentOS

as seen on Server Fault - Search for 'Server Fault'
[root@ip ~]# yum install php-pear* Reducing CentOS-5 Testing to included packages only Finished Setting up Install Process Package 1:php-pear-1.8.1-2.el5.centos.noarch already installed and latest versio … >>> More
Apache configurations for php "AddType text/html php" or "AddType application/x-httpd-php php .php"

as seen on Server Fault - Search for 'Server Fault'
I am taking over an application server and discover that it contain the following settings: AddType text/html php Although it works, but my understanding is that it should set as following: AddType application/x-httpd-php php .php What are the key differences between the two settings?… >>> More
mod_rewrite settings causes server to throw HTTP 500 errors instead of 404

as seen on Server Fault - Search for 'Server Fault'
Hello. I have a server with VBulletin forum (working under Apache 2.2, CentOS). The default settings for it in .htaccess are as follows: RewriteEngine on RewriteCond %{HTTP_HOST} ^gsmforum\.ru RewriteRule (.*) http://www.gsmforum.ru/$1 [R=301,L] # If you are having problems or are using VirtualDocumentRoot… >>> More
Problems installing Memcache (PECL extension)

as seen on Server Fault - Search for 'Server Fault'
I have installed memcached fine, and now I will need to install PECL extension memcache. Im running RedHat x86_64 es5. The installation gives me this: downloading memcache-2.2.6.tgz ... Starting to download memcache-2.2.6.tgz (35,957 bytes) ..........done: 35,957 bytes 11 source files, building running:… >>> More

Related posts about filtering

Problem Disabling Roaming Profiles on Grouped Users

as seen on Server Fault - Search for 'Server Fault'
I'm having some serious issues getting a group of users to stop using roaming profiles. As expected, I have roaming profiles enabled accross the domain. - But am doing GPO filtering, limiting the scope. I originally had it set to authenticated users for Roaming, but as the domain has branched out… >>> More
ASP.Net MVC2 (RTM) breaks response filtering - "Filtering is not allowed"

as seen on Stack Overflow - Search for 'Stack Overflow'
I've just done a test run of upgrading a project to ASP.Net MVC 2 (RTM) in anticipation of the full official .Net 4.0 release coming later this month. Our application is using a minimizer for our CSS and javascript. To do so, it is making use of the HttpResponse.Filter property to set a custom filter… >>> More
Filtering a collection based on filtering rules

as seen on Stack Overflow - Search for 'Stack Overflow'
I have an observable collection of Entities, with each entity having a status added, deleted, modified and cancelled. I have four buttons (toggle) when clicked should filter my collection as below: If I select the button Added, then my collection should contain entities with status added. If I… >>> More
Accessing and Updating Data in ASP.NET: Filtering Data Using a CheckBoxList

as seen on Internet.com - Search for 'Internet.com'
This article series, by Scott Mitchell, examines how to work with data using ASP.NET's data source controls. This particular article looks at how to filter data based on a user's selections from a CheckBoxList. >>> More
Accessing and Updating Data in ASP.NET: Filtering Data Using a CheckBoxList

as seen on 4 Guys From Rolla - Search for '4 Guys From Rolla'
Filtering Database Data with Parameters, an earlier installment in this article series, showed how to filter the data returned by ASP.NET's data source controls. In a nutshell, the data source controls can include parameterized queries whose parameter values are defined via parameter controls. For… >>> More