Wysiwyg and embeded videos - is there PHP filtering class
I want to let my 'untrusted' users to use wysiwyg plus to embed videos (at least from YouTube) in their posts. Is there a universal P开发者_StackOverflow中文版HP class to filter outputs to protect from xss?
The issue should not only be limited to preventing XSS when adding a YouTube link, what about the rest of the content? There are a couple of options for handling the output of what users may enter, see:
Sanitize
and
AntiSamy
Nope. Your best bet is to create a new button for embedding the video. And ditching wysiwyg plus if it doesn't use some kind of bb code. Or accept the possibility of XSS.
精彩评论