CKeditor是否可以安全地允许最终用户提交内容？ [英] Is CKeditor safe for letting end-users submit content?

问题描述

我要让一些用户在我的网站上发布文章。

I am about to let some users publish articles on my site.

为了让他们更轻松，我正在考虑使用CKeditor，让他们拥有链接，图像，格式等...

To make it easier for them, I was thinking of using a CKeditor, let them have links, images, formating, etc ...

但是我一直在考虑javascript。有人可以注入JavaScript还是CKeditor会清理它？我需要自己过滤吗？

However I was thinking of javascript. Can someone inject javascript or will CKeditor clean it up? Do I need my own filtering?

推荐答案

用户提交的内容应始终进行检查，即使CKeditor之类的应用程序生成了有效内容也是如此。码。您可以使用 HTMLPurifier 进行服务器端清理。

Content submitted by the user should always be checked, even if an application like CKeditor generates valid code. You can use HTMLPurifier for serverside sanitizing.

这篇关于CKeditor是否可以安全地允许最终用户提交内容？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！