What are the best practices for handling WsiWyg text from an editor like YUI Rich Text Editor?
I'm looking for any experience someone can share about using a rich text editor like the YUI text editor. Specifically, I'm interested in how to deal with problems or prevent problems using
- Cross-site scripting
- Image or attachment processing
Any similar questions you may provide for links or articles on the internet would be appreciated.
a source to share
The recommended way is to use a whitelist. We are using Antisamy for it and some custom XPath expressions. with antisamia you can determine which tags and which attributes are allowed. For attributes, you can define lists of valid values or regular expressions that describe a valid value. The cross-site scripting issue can be mitigated with whitelisting.
http://www.owasp.org/ has many good resources and best practices for web application security. (So you can read about other issues like Cross Site Request Forgery, SQL injection, ...)
What questions do you have regarding image processing or attachments?
a source to share