Clash Royale CLAN TAG#URR8PPP

Store TinyMCE form data in a MySQL database and return as is

I am currently in a CMS project and we wish to use TinyMCE as our WYSIWYG editor. In here, we have allowed users to customize their content (such as some sections are bold, different indentations etc. ) All I want to know is, how do we store those form data in a MySQL database, and how do we return data from those styles? Are there problems in database, as this contains html tags? I think you may get what im asking. This is our first time using any of WYSIWYG editor and Thank you for any help..

1 Answer
1

To MySQL, the HTML generated by TinyMCE is just a String, you can store it as it is (after your security filter has validated it)

But, your application must handle the Strong very carefully because careless handling will result in Cross Site Scripting (XSS).

It's more difficult than preventing XSS on non-html fields because output sanitizing won't work.

The most robust way to prevent XSS on HTML field is that you will need filter the HTML text in the server , whitelist or blacklist.

Blacklist is easier to implement, but may miss some patterns we didn't know. Whitelist is more robust but troublesome. you will define the tags and attributes you allowed, HTML contains invalid tags or attributes can either be filtered or blocked. You can achieve whitelist by Jsoup ( for better performance, I will suggest you to customize Jsoup)

You can not trust tinymce to help you, because a hacker can easily bypass the client side validation.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.