开发者

Wysiwyg and embeded videos - is there PHP filtering class

开发者 https://www.devze.com 2023-01-27 05:52 出处:网络
I want to let my \'untrusted\' users to use wysiwyg plus to embed videos (at least from YouTube) in their posts. Is there a universal P开发者_StackOverflow中文版HP class to filter outputs to protect f

I want to let my 'untrusted' users to use wysiwyg plus to embed videos (at least from YouTube) in their posts. Is there a universal P开发者_StackOverflow中文版HP class to filter outputs to protect from xss?


The issue should not only be limited to preventing XSS when adding a YouTube link, what about the rest of the content? There are a couple of options for handling the output of what users may enter, see:

Sanitize

and

AntiSamy


Nope. Your best bet is to create a new button for embedding the video. And ditching wysiwyg plus if it doesn't use some kind of bb code. Or accept the possibility of XSS.

0

精彩评论

暂无评论...
验证码 换一张
取 消