11

There are lots of template files like this one views-view-fields--magazine--magazine.tpl.php in my website. how and when I should use the filter_xss() and check_plain() to improve security? for example this is the code:

<div>
    <div class="bf-header bf-article-header"><?php print $fields['title']->content; ?></div>
    <div class="bf-article-body"><?php print $fields['field_magazine_body']->content;?></div>
    <div class="bf-article-image"><?php print $fields['field_magazine_image']->content;?></div>
</div>
<div class="separator article-view-separator"></div>

How do I can apply those functions in it?

Improve this question
1
  • Use filter_xss() when you want to filter XSS from potentially dangerous content (i.e. content from an untrusted user), and check_plain() when you want to escape HTML special characters from a string
    – Clive ♦
    May 22, 2014 at 12:48

1 Answer 1

Reset to default
13

First, read up about these in the Drupal API:

So check_plain() encodes special characters that has special meaning in HTML (such as < and &) into plain text entities (i.e. &lt; and &amp; respectively) that will make these be rendered literally (not interpreted as HTML) when that string that is then displayed as part of a page with HTML-markup. The function filter_xss() filters an HTML string to prevent cross-site-scripting (XSS) vulnerabilities. It does four things:

  • Removing characters and constructs that can trick browsers
  • Making sure all HTML entities are well-formed
  • Making sure all HTML tags and attributes are well-formed
  • Making sure no HTML tags contain URLs with a disallowed protocol (e.g. javascript:)

Both functions are used to sanitize data from users to make sure that any user injection is neutralized before the data is rendered on your site.

You never pass the same string through both.

If you use check_plain() then the string passed to the function is supposed to be used as plain text (not HTML). Then filter_xss() is not needed, since check_plain() will always make the string plain text.

If you use filter_xss(), then the string passed to the function is supposed to be HTML, and check_plain() will mess it up.

When I look at the template you use as example, it looks to me as if all three fields passed to print() comes from content that is already sanitized, and need no more sanitation.

However, if you create your own module that collects user input without passing it through a "safe" text filter such as "Filtered HTML" or "Plain", you must use these functions for sanitation purposes.

Improve this answer
9
  • Where do I can check for inputs come from users? for example there is a content type and anonymous users are allowed to create that kind of nodes.
    – M a m a D
    May 22, 2014 at 13:51
  • @Drupalist, you should never allow the Anonymous user to use an "unsafe" text format. Navigate to Administration » Configuration » Content authoring » Text Formats. The "safe" text formats that comes with Drupal are "Filtered HTML" and "Plain text". If these are the only formats allowed for the Anonymous user, Drupal performs the required checks for you for any built-in node type and any node type you create with the core Fields feature. If your use case is different from this, ask a new question spelling out the use case.
    – Free Radical
    May 22, 2014 at 14:00
  • Anonymous users are only allowed to use plain text
    – M a m a D
    May 24, 2014 at 13:03
  • @Drupalist, that's fine. There is no need to use these functions to sanitize Plain text.
    – Free Radical
    May 24, 2014 at 13:11
  • 3
    @ARUN, no. Standard Drupal practice is to always save exactly what the user types in the DB, and to sanitize text before rendering.
    – Free Radical
    Aug 30, 2016 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.