For the MySQL based web page and the Description field insertion and update, I’m used to clean the Description field with the following:
mysql_real_escape_string(Description)
When the Kendo editor is now used, such a clean process screws up the resulting data, and ends in incorrect data when the data is then read back from server for the hyperlinks as an example. For a hyperlink, for the original string http://www.vg.no the resulting string when read back from database becomes \"http://www.vg.no\", the original tooltip "VG sidene" becomes \"VG and the original checked option for Open link in new window becomes unchecked.
Do you have an idea about what’s going on here? How to utilize this standard cleaning mechanism mysql_real_escape_string for the editor usage?
mysql_real_escape_string(Description)
When the Kendo editor is now used, such a clean process screws up the resulting data, and ends in incorrect data when the data is then read back from server for the hyperlinks as an example. For a hyperlink, for the original string http://www.vg.no the resulting string when read back from database becomes \"http://www.vg.no\", the original tooltip "VG sidene" becomes \"VG and the original checked option for Open link in new window becomes unchecked.
Do you have an idea about what’s going on here? How to utilize this standard cleaning mechanism mysql_real_escape_string for the editor usage?
1 Answer, 1 is accepted
0
Hello Jan Kaare,
Alex Gyoshev
the Telerik team
Please consider using prepared statements instead of mysql_real_escape_string. While the latter may prevent SQL injection attacks, it will not help with XSS exploits. See the following SO thread for more information. The advice of using the HTML Purifier library is also worth taking, as it will secure that only valid content will be saved on the server.
Kind regards,Alex Gyoshev
the Telerik team
Join us on our journey to create the world's most complete HTML 5 UI Framework - download Kendo UI now!