Zikula Community

• craigh
  
  

  • Rank: Developer
  • Registered: Jun 16, 2003
  • Last visit: May 29, 2010
  • Posts: 1966

  Posted: Dec 09, 2009 - 12:35 PM

  How is allowedHTML implemented in a module? If I allow HTML input in my module, is disallowed HTML stripped out somewhere along the line automatically (DBUtil::insertObject ??). I know that using DataUtil::formatForDisplayHTML() eliminates it from display, but is it ever stripped before entering the DB?
  
  ultimate question: Do I need to do something in my module as I validate my user entry to ensure security in my module or is this handled automatically?

  • 
  •  
• nestormateo
  
  

  • Rank: Team Member
  • Registered: Sep 06, 2006
  • Last visit: May 09, 2010
  • Posts: 2446

  Posted: Dec 09, 2009 - 03:50 PM

  The AllowedHTML is a responsability of the "Presentation Layer", then, your templates are the responsible ones to strip the not allowed tags with |pnvarprepfordisplay. But those settings can change in different ways, like change the output filter to Internal instead SafeHTML, so, makes no sense to strip them when storing the data in the Database.
  
  DBUtil sanitizes the data that you're storing in the data base. If you're performing "manual" SQL queries, use DataUtil::formatForStore for each variable in that SQL.
  
  --
  - Mateo T. -
  Mis principios... son mis fines

  • 
  •  
•  
•  

Users on-line

• 0 users

This list is based on users active over the last 60 minutes.