0

Possible Duplicate:
Is check_plain() enough?

When authoring own plugin/formatter and giving user an option to provide their own HTML prefix and suffix strings , what would be the Drupal way of ensuring safety of those strings? Would it suffice to filter_xss with custom list of allowed tags, or a sequence of some functions would be required?

0

Treat it like any other user input; that is, not to be trusted. Do you have a reason to allow HTML tags in the prefix/suffix? If not, output only after running through check_plain(). filter_xss() is quite permissive in its allowed tags so just be sure you're OK with that before using. See also the drupal.org documentation on handling text in a secure way.

Not the answer you're looking for? Browse other questions tagged or ask your own question.