im trying to use TinyMCE as part of a web form. Integration works fine, but as soon as you submit the form, of course, the data will be verified.
If the validation is false, for example, some other input was not filled, then, of course, I do not want the user to return all the data. Therefore, I pass the contents of Tinymce back to the reloaded view.
The following problem occurs:
Content in Tinymce Textarea: test
Tinymce content after reboot: <p>test</p>
Thus, an extra paragraph is added as a wrapper each time.
I want Tinymce to process the input as if it were inserted into the html view, so that the plain text will be fine and extra paragraphs will not be inserted.
How can i achieve this?
Thanks for your reply. This is just an example of input, I definitely need RTE as I create some custom CMS features. Now I worked with html_entity_decode (), html comes from the database, and yes, I filter the user input correctly (mostly CI, but I tested XSS myself to make sure ...). I'm not sure if I am doing this in the most elegant way ... but everything seems to work fine for me:
JS Part:
<script type="text/javascript" src="<?php echo base_url();?>tinymce/jscripts/tiny_mce/tiny_mce.js"></script> <script type="text/javascript"> $(document).ready(function(){ tinyMCE.init({ theme : "advanced", mode : "textareas", theme_advanced_buttons1 : "save,newdocument,|,bold,italic,underline,strikethrough,|,justifyleft,justifycenter,justifyright,justifyfull,|,styleselect,formatselect,fontselect,fontsizeselect", theme_advanced_buttons2 : "cut,copy,paste,pastetext,pasteword,|,search,replace,|,bullist,numlist,|,outdent,indent,blockquote,|,undo,redo,|,link,unlink,anchor,image,cleanup,help,code,|,insertdate,inserttime,preview,|,forecolor,backcolor", theme_advanced_toolbar_location : "top", theme_advanced_toolbar_align : "left", entity_encoding : "raw", content_css : "<?php echo base_url();?>xcss/standard_tinymce.css", }); }); </script>
Generate a textarea form (CI path):
echo form_textarea('content', html_entity_decode($content));
Here it is.
Input like:
<p><strong>test</strong></p><p>bla bla bla</p>
The following path will now be shown in tinymce if it was saved in $ content:
test
bla bla bla
And if you submit the form, then the post data will again be equal to $ content. And this is exactly the moment when you should consider checking that the messages are for injection or XSS attacks, so please do not do it the same way if you do not keep track of what will happen next ... my solution is probably is not very safe in ALL cases, in my case, this is normal, I suppose, but if someone knows better, I definitely want to know more about this;)