How to control HTML user input preserving the "style" attributes?
Hello there, I am creating an about_me.module to provide users with a customizable "about me" page. That page is to be very simple: a title field and a textarea for users to write whatever they want. Ideally, users should be able to customize their pages either by writing directly in HTML or by using TinyMCE. The problem that I'm having is that the formatting added by TinyMCE (especially the "style" attributes) are being filtered out by filter.module. An alternative would be to not filter the HTML tags at all, but I'm afraid that would add potential risks to my website. Is there any solution for this problem? What would you recommend? Thanks in advance, Leo
"Leo Burd" wrote:
I am creating an about_me.module to provide users with a customizable "about me" page.
There are already modules (several) which do this. 'Bio' comes to mind, as does 'User Nodes' (this does more than just provide an 'about me', but it can do that with a new node type.) There may be even more modules which do this [but using one module for many tasks is better and their are modules which are less specific but allow the same thing...and more.] So many folks try to reinvent the wheel [1] with tasks like this. I don't know if they just can't find the module which already does this, or if they just suffer from NIH syndrome [2]. If it is a search issue, then perhaps the infrastructure folks could take that under advisement and examine alternate search methods ('see also', cross-listed, 'related to', etc.) That's a chore, of course, but may well be worth it to prevent the task clutter which seems to afflict the contributed modules listings. -- inkfree [1] "reinvent the wheel [RTW]" <http://en.wikipedia.org/wiki/Reinventing_the_wheel> [2] "not invented here [NIH]" <http://en.wikipedia.org/wiki/Not_invented_here>
Hi Leo, Maybe you are interested in looking at the usernode or bio modules before you start off with another module with this functionality :) Gabor Leo Burd wrote:
Hello there,
I am creating an about_me.module to provide users with a customizable "about me" page. That page is to be very simple: a title field and a textarea for users to write whatever they want. Ideally, users should be able to customize their pages either by writing directly in HTML or by using TinyMCE.
The problem that I'm having is that the formatting added by TinyMCE (especially the "style" attributes) are being filtered out by filter.module. An alternative would be to not filter the HTML tags at all, but I'm afraid that would add potential risks to my website. Is there any solution for this problem? What would you recommend?
Thanks in advance,
Leo
participants (3)
-
Gabor Hojtsy -
inkfree press -
Leo Burd