You don't want check_plain and check_markup together. Just use check_markup and the appropriate filter (or create one that does the filtering you want).

One other thing:

$text = check_markup($text,1);

That's fine for D7, but D6 should be:

$text = check_markup($text, 1, FALSE);

That prevents any permission problems.

In D7 if you want to cache the filtered output, then use:

$text = check_markup($text, 1, '', TRUE);

Jamie Holly http://www.intoxination.net http://www.hollyit.net

On 9/26/2012 6:55 AM, Vaibhav Jain wrote:

Nancy,

I am trying to escape XSS attacks, like alerts.... and on the same end, want to convert text URL into links.

I am doing this $text = check_plain($text); $text = check_markup($text,1); print $text;

is this a correct way, or can there be a better way to achieve this.

On Wed, Sep 26, 2012 at 4:19 PM, Ms. Nancy Wichmann <nan_wich@bellsouth.net mailto:nan_wich@bellsouth.net> wrote:

The standard Drupal mantra is "Filter on output." So do not filter
before saving to the DB. You should filter when rendering the
data. You should not use both functions together - that's asking
for double encoding issues. Check_markup() will run the data
through your input filters and make it safe - assuming that your
filters are properly set up.
/*Nancy*/
Injustice anywhere is a threat to justice everywhere. -- Dr.
Martin L. King, Jr.

    ------------------------------------------------------------------------
    *From:* Vaibhav Jain

    I am using D6, want to use check_plain and check_markup functions.
    What is the best time to use these functions and why ?
    Should they be used before data is saved to DB
    OR
    Just before the data is rendered.

    I am trying to use both the functions on the same piece of
    text, firstly escape with check_plain and then implement
    check_markup to implement few set of filters.


--
[ Drupal support list | http://lists.drupal.org/ ]

-- Regards, Vaibhav Jain