0

I thought I understood text filters, but it appears I don't.

I am using a filter on my node's "body" field that is supposed to restrict tags. I have entered the allowed HTML tags as

<em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd> <br>

Yet in my WYSIWYG editor I can switch to source view and save text that includes (or worse, ) tags.

Why aren't these tags stripped out when the node is saved?

Improve this question
4
  • Are you using CKeditor?
    – No Sssweat
    Aug 13, 2016 at 5:39
  • Yes, CKEditor. Version 4.4.7 I believe.
    – Graham
    Aug 15, 2016 at 1:40
  • check your /admin/config/content/formats/filtered_html and make sure those tags are in the allowed tags. (Assuming you are using Filtered HTML as your format)
    – No Sssweat
    Aug 15, 2016 at 3:10
  • The string of tags in my question above is the one for my text filter, copied and pasted from the text filter config. I've been able to add "script", "img", and "a" tags with no issues, even though they should be stripped out when saving the node (if I understand the text filtering system correctly).
    – Graham
    Aug 15, 2016 at 13:12

1 Answer 1

Reset to default
1

Okay, I've found my own answer. The problem was with my understanding of how text filters work. Text is saved into the database with no changes, and filters are only applied when the text is output.

When using Entity Metadata Wrappers, as I am, when you get $wrapper->body->value(), it gives you an array with several elements. One is the "value", which is the raw, unfiltered text. Another is the "safe_value", which has had filters applied.

So in my case I needed to use the "safe_value" when displaying the text. Makes sense once you understand it!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.