show html tags in template - symfony and CKEDITOR. how safety?

0
votes

i use Symfony 1.4 and Doctrine 1.2. I installed plugin http://www.symfony-project.org/plugins/sfCkPlugin if i add net data from form this working ok, but in template this show me for example:

<p><b>bold</b> <i>test</i></p>

etc

instead of

bold test

I must something add here: getDesc() ?> , but what?

In database MySQL i have: 

<p> <strong>bold</strong> <u>test</u></p>

this is safety?

1
phphtmlsymfony1ckeditorbbcode

1 Answers

1
votes

This is happening because of the output escaper in symfony.

You can fix it by calling getRawValue() on the data:

$obj->getDesc()->getRawValue();

Bear in mind that if you do this, you need to ensure that the html/javascript/whatever else has been entered is safe to output on the page. If it's coming from a backend, you are probably ok. But if it's coming from end users, you should ensure you make it safe (block XSS attacks, prevent html that breaks the layout, etc). It's a big topic!