HTML-Purifier

[ghost]

This supplement could be added to clean up the fields an HTML Purifier

<?php
if (!defined('BASEPATH')) {
    exit('No direct script access allowed');
}
/*
 * Codeigniter HTMLPurifier Helper
 *
 * Purify input using the HTMLPurifier standalone class.
 * Easily use multiple purifier configurations.
 *
 *
 * @access  public
 * @param   string or array  $dirty_html  A string (or array of strings) to be cleaned.
 * @param   string           $config      The name of the configuration (switch case) to use.
 * @return  string or array               The cleaned string (or array of strings).
 */
if (!function_exists('html_purify')) {
    function html_purify($dirty_html, $config = false)
    {
        require_once APPPATH.'third_party/htmlpurifier-4.8.0-standalone/HTMLPurifier.standalone.php';
        if (is_array($dirty_html)) {
            foreach ($dirty_html as $key => $val) {
                $clean_html[$key] = html_purify($val, $config);
            }
        } else {
            $ci = &get_instance();
            switch ($config) {
                case 'comment':
                    $config = HTMLPurifier_Config::createDefault();
                    $config->set('Core.Encoding', $ci->config->item('charset'));
                    $config->set('HTML.Doctype', 'XHTML 1.0 Strict');
                    $config->set('HTML.Allowed', 'p,a[href|title],abbr[title],acronym[title],b,strong,blockquote[cite],code,em,i,strike');
                    $config->set('AutoFormat.AutoParagraph', true);
                    $config->set('AutoFormat.Linkify', true);
                    $config->set('AutoFormat.RemoveEmpty', true);
                    break;
                case false:
                    $config = HTMLPurifier_Config::createDefault();
                    $config->set('Core.Encoding', $ci->config->item('charset'));
                    $config->set('HTML.Doctype', 'XHTML 1.0 Strict');
                    break;
                default:
                    show_error('The HTMLPurifier configuration labeled "'.htmlspecialchars($config, ENT_QUOTES, $ci->config->item('charset')).'" could not be found.');
            }
            $purifier = new HTMLPurifier($config);
            $clean_html = $purifier->purify($dirty_html);
        }
        return $clean_html;
    }
}
/* End of htmlpurifier_helper.php */
/* Location: ./application/helpers/htmlpurifier_helper.php */

[sv3tli0]

HTMLPurifier is good thing, but I believe that it should stay as optional feature not directly into the core..

The security should have some good base core level. For deeper security over specific inputs there can be made additional "CI-Advanced-Security" package..

[lonnieezell]

CodeIgniter already uses Zend/Escaper which does much of the same thing.

Thanks for helping to encourage security in the framework, though!