What to validate when saving user ckeditor html data into a database?

No, you shouldn't worry about this. As far as you use parametrized queries in order to store data to avoid SQL injection a relational database doesn't care much about what kind of text you are throwing at it.

As far as I know ckeditor do not supply any build in xss protection (you should always verify such things on server side). In addition to Darin Dimitrov answer I can say that in my recent project I need to display user input as html, and do not encode it. If you face similar situation (and you almost definitelly are - usually there is no point of using ckeditor and ignore format) - look at: http://refactormycode.com/codes/333-sanitize-html If this is your case - just sanitize html using Sanitize method from the post and then you can display it as it is.

I cant really gove you an answer,but what I can give you is a way to a solution, that is you have to find the anglde that you relate to or peaks your interest. A good paper is one that people get drawn into because it reaches them ln some way.As for me WW11 to me, I think of the holocaust and the effect it had on the survivors, their families and those who stood by and did nothing until it was too late.

Related Questions