Quantcast
Channel: Editor — DataTables forums
Viewing all articles
Browse latest Browse all 3744

Prevent Sanitizing of "" etc

$
0
0

Hi,
though I understand it's coming from a security aspect, when submitting text through DataTables editor (php version), sometimes - the field represents free text or HTML, and if I submit text that has special characters such as "<" and ">", they are inserted into the database as "<" and ">".

This is bad in 2 cases:
1. If this user on the DatatTables page is a trusted user, and needs to inject HTMLdata into a field.
2. Even if it's an untrusted user, but it's legit to type something like: "Day 1 > Breakfast > Eggs" - this should be "plain as is" in the DB, and in this case, just needs to be converted to the special characters with their corresponding HTML codes.

The fact of the using is being trusted or not is not really relevant to this question, but bottom line -
How can I make it that if I write "<" in a field vie the editor, it will be inserted to the Database as "<" and not as "&lt"?


Viewing all articles
Browse latest Browse all 3744