show html tags in template - symfony and CKEDITOR. how safety?

﹥>﹥吖頭↗ 提交于 2019-12-12 02:05:43

问题


i use Symfony 1.4 and Doctrine 1.2. I installed plugin http://www.symfony-project.org/plugins/sfCkPlugin if i add net data from form this working ok, but in template this show me for example:

<p><b>bold</b> <i>test</i></p>

etc

instead of

bold test

I must something add here: getDesc() ?> , but what?

In database MySQL i have:

<p> <strong>bold</strong> <u>test</u></p> 

this is safety?


回答1:


This is happening because of the output escaper in symfony.

You can fix it by calling getRawValue() on the data:

$obj->getDesc()->getRawValue();

Bear in mind that if you do this, you need to ensure that the html/javascript/whatever else has been entered is safe to output on the page. If it's coming from a backend, you are probably ok. But if it's coming from end users, you should ensure you make it safe (block XSS attacks, prevent html that breaks the layout, etc). It's a big topic!



来源:https://stackoverflow.com/questions/7051847/show-html-tags-in-template-symfony-and-ckeditor-how-safety

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!