Databases
StackOverflow2013
Postsdbo
PO
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    text
    copied!<p>This is what I use when I want to eliminate XSS, HTML and still preserve the user post content (even malicious code attempts) </p> <pre><code>private function stripHTMLtags($str) { $t = preg_replace('/&lt;[^&lt;|&gt;]+?&gt;/', '', htmlspecialchars_decode($str)); $t = htmlentities($t, ENT_QUOTES, "UTF-8"); return $t; } </code></pre> <p>The first regex remove everything that has a html format and the htmlentities takes care of quotes and stuff. Use it on your controller everytime you need to REALLY clean things up. Fast and simple.</p> <p>Eg., this very malicious str with lots of codes tags and stuff</p> <pre><code>Just another post (http://codeigniter.com) blablabla text blabla:&lt;/p&gt;1 from users; update users set password = 'password'; select * &lt;div class="codeblock"&gt;[aça]&lt;code&gt;&lt;span style="color: rgb(221, 0, 0);"&gt;'username'&lt;/span&gt;&lt;span style="color: rgb(0, 119, 0);"&gt;);&amp;nbsp;&lt;/span&gt;&lt;span style="color: rgb(255, 128, 0);"&gt;//&amp;nbsp;filtered&lt;br&gt;&lt;/span&gt;&lt;span style="color: rgb(0, 0, 187);"&gt;- HELLO I'm a text with "-dashes_" and stuff '!!!?!?!?!$password&amp;nbsp;&lt;/span&gt;&lt;/span&gt; </code></pre> <p>&lt;ok.&gt;</p> <p>Becomes </p> <pre><code>Just another post (http://codeigniter.com) blablabla text blabla:1 from users; update users set password = 'password'; select * [aça]'username');&amp;nbsp;//&amp;nbsp;filtered- HELLO I'm a text with "-dashes_" and stuff '!!!?!?!?!$password&amp;nbsp; &lt;ok.&gt; </code></pre> <p>It still have the code, but that won't do anything on your db. Use it like </p> <pre><code>$this-&gt;stripHTMLtags($this-&gt;input-&gt;post('html_text')); </code></pre> <p>You can put this function inside a library so you don't have to hack CI :)</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload