What validation rules should I have for a WYSIWYG editor input?

Hello,

I started using TinyMCE and currently the only validation rule I have is string (and min/max). But is it correct? Are there any more important validation rules I need to add to the input? From what I've seen, the <script> tags are already stripped

Ty!

dualklip

2 years ago

Level 2

In terms of rules I think what your are doing it's ok. If you want to implement more logic around this you can use the HTML Purifier package (ezyang/htmlpurifier) or other similar to eliminate any potential XSS attacks.

This is an example of one of my implementations

$request->validate([
    'editorContent' => [
        'required', 
        'string', 
        'max:3000', // Adjust the value to suit your requirement
    ],
]);

1 like

Robstar

2 years ago

Level 50

You'll also most likely want to filter out HTML as the suggestions from @dualklip will allow anything.

https://github.com/stevebauman/purify is good and will give you fine grained control over what is and isn't allowed.

Ultimately, I'm all for only storing safe and expected HTML in my database.

1 like

Ligonsker

2 years ago

Level 8

@dualklip @robstar thank you, I didn't know about these packages, and will take a look

Please or to participate in this conversation.