Codeigniter - Disable XSS filtering on a post basis

user_375420 0
Viewed 17815

I'm trying to set up a CMS on the back of a site but whenever post data has a <a href=... in it the post data gets scrapped.

I've got $config['global_xss_filtering'] = TRUE; in config

My question is there a way of disabling xss filtering for one item?

e.g.

$this->input->post('content', true); - turns it on, but how to turn it off?

Thanks everyone.

PVS

codeigniter xss
7 Answers

If you want to keep global xss_clean enabled and override on only certain cases, you can extend the Input library to keep a clone of $_POST for providing raw data when asked:

<?php if (!defined('BASEPATH')) exit('No direct access allowed.');
class MY_Input extends CI_Input {

public function __construct() {
    $this->_POST_RAW = $_POST; //clone raw post data 
    parent::__construct(); 
}

public function post($index = null, $xss_clean = TRUE) { 
    if(!$xss_clean){ //if asked for raw post data -eg. post('key', false)-, return raw data. Use with caution.
        return $this->_POST_RAW[$index];
    }
    return parent::post($index, $xss_clean); 
    }
}
?>

This way you can use $this->input->post('mydata', FALSE) to retrieve un-sanitized raw post data even if xss_clean is enabled globally.

user_29660840

Yes, the extension to Input with the post method replacement was very useful, as was the astute reader who notice that it should be return parent::post($index, $xss_clean). I was getting errors and didn't think about that obvious error. Fixed it and I'm off and running.

We're using it to escape post data for use in sql statements. Although CI's db methods are nice, we have some large sql statements that are easier to code by hand.

user_3985170
Related