Codeigniter 2.1 - insert HTML page into database

Question

I am trying to create mini CMS, where user can create new page and then that page become part of menu. Is it smart to insert full pages into database or there is better way to do so? Also I am having a bit of the problem with a tag when I am inserting. Code for now:

For inserting page into db:

public function strana_insert()
    {
        $this->admin_login_check();
        $clear = $this->str->clean_request();

        $char  = array('\n', '\n');
        $strana  = str_replace($char, '<br>', $clear['opis']);
        $kljucna_rec = str_replace( ' ', '_', mb_convert_case($clear['naziv'], MB_CASE_LOWER, "UTF-8") );
            $data = array(
            'naziv'           => $clear['naziv'],
            'strana'          => htmlspecialchars($strana, ENT_QUOTES , "UTF-8"),
            'kljucna_rec'     => $kljucna_rec,
            'datum_kreiranja' => date("Y-m-d H:i:s")
        );
        $this->str->save($data);
        $this->save_routes();
        redirect('admin');
    }

Code for clean_request function:

public function clean_request()
    {
        foreach($_POST as $key=>$value) :
            $clean[$key]=mysql_real_escape_string(trim($value));
        endforeach;

        return $clean;
    }

When I insert page with a tag I get following result:

<a href=\"http://www.example.com\" class=\"link_name\">www.example.com</a>

After updating page everything between *\ * is deleted. What is going on here?

Don't use mysql_real_escape_string, use the framework's DB class with bindings (or Active Record). The backslashes could be the magic_quotes setting on your server; turn them off — Damien Pirsy
– Damien Pirsy, Commented Feb 12, 2013 at 12:53

Mansoorkhan Cherupuzha · Accepted Answer · 2013-07-25 12:57:13Z

3

You can use Codeigniter's active class to insert this OR use the following method.

before inserting HTML data to database do this :

$html_for_db = addslashes($html_content);

and insert $html_for_db to database.

While displaying this content,

echo stripcslashes($data_from_db);

stripcslashes() - Un-quote string quoted with addcslashes

More info : http://php.net/manual/en/function.addslashes.php

edited Jul 25, 2013 at 12:57

answered Feb 12, 2013 at 13:12

Mansoorkhan Cherupuzha

1,7611 gold badge24 silver badges45 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Damien Pirsy Over a year ago

Why! why using addslashes? If you want to escape a string, it's wrong, especially since the framework provides better ways to do that natively. If you want to escape html, addslashes makes no sense

Mansoorkhan Cherupuzha Over a year ago

@DamienPirsy, Thanks for your valuable information let me search and edit my answer.

Nima Ghaedsharafi · Accepted Answer · 2017-07-14 09:56:24Z

3

it's because of escape function!! htmlspecialchar change your code to just a simple string!!

if you'd like to save as html you should save the code without escaping!

BTW, This isn't an smart way to create a static pages, You may like to create a layout and simply let users put content in it ;)

edited Jul 14, 2017 at 9:56

answered Feb 12, 2013 at 12:56

Nima Ghaedsharafi

4231 gold badge7 silver badges16 bronze badges

5 Comments

Sasha Over a year ago

This is the way I am doing it. Layout for the page is already set, but there is a need for few tweaks (class here and there, bold text and so on).

Nima Ghaedsharafi Over a year ago

btw , codeigniter escape your code automatically for having safer query; resource : ellislab.com/codeigniter/user-guide/database/active_record.html

Nima Ghaedsharafi Over a year ago

simply , do not escape the content .

Nima Ghaedsharafi Over a year ago

could you give me a shot about your database field!!?

Sasha Over a year ago

Type of the field is longtext.

naabster · Accepted Answer · 2013-02-12 13:48:50Z

1

If you want to store html in your DB I recommend using htmlpurifier to clean up your html code and also strip out unwanted html tags.

http://htmlpurifier.org/

There is also a helper which makes using htmlpurifier within CodeIgniter really easy: https://github.com/refringe/codeigniter-htmlpurifier

After you cleaned your input string with htmlpurifier you should use Codeigniters Active Record class to insert your data (http://ellislab.com/codeigniter/user-guide/database/active_record.html). This way the framework will do the escaping.

answered Feb 12, 2013 at 13:48

naabster

1,55212 silver badges14 bronze badges

Comments

Francois Bourgeois · Accepted Answer · 2013-02-12 13:18:08Z

0

You have to prevent two types of attacks here: SQL injection and cross-side scripting. You considered both and used htmlspecialchars() against XSS and mysql_real_escape_string() against SQL injection.

But you used them in the wrong order. You first have to use htmlspecialchars, because that's the thing you want to store/output. To put it savely into the database you have to wrap it into its mysql_real_escape_string-ized presentation before storing it or use parameter binding instead.

answered Feb 12, 2013 at 13:18

Francois Bourgeois

3,7185 gold badges34 silver badges41 bronze badges

Collectives™ on Stack Overflow

Codeigniter 2.1 - insert HTML page into database

4 Answers 4

2 Comments

5 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

5 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related