Global XSS filtering and disable individually

[eluser]asumaran[/eluser]
Why if I set

Code:

$config['global_xss_filtering'] = TRUE;

when

Code:

$company_name = $this->input->post('company_name', FALSE);

is giving me a xss filtered value?

[eluser]sangprabo[/eluser]
How is it going?

Code:

$company_name = $_POST['company_name'];

[eluser]P.T.[/eluser]
[quote author="asumaran" date="1312024173"]Why if I set

Code:

$config['global_xss_filtering'] = TRUE;

when

Code:

$company_name = $this->input->post('company_name', FALSE);

is giving me a xss filtered value?[/quote]

Because the filter happens long before you call $this->input->post. The XSS filtering is one of the first things CI does.

[eluser]Dandy_andy[/eluser]
I had a problem with global XSS filtering but have come up with a solution. Might not be the best way to do things, but it works. The way I get round disabling the global XSS filter for a POST request is to do the following:-

I use the following code where the XSS filter needs to be disabled (for example to allow scripts and code to be added to the database)

Code:

$input = html_entity_decode($input);

which essentially converts all the characters back again. This seems to work and has enabled me to allow scripts and code to be added to the database without turning off the global XSS filtering (as I have a lot of inputs elsewhere that need it).

[eluser]InsiteFX[/eluser]
You do not need to turn on the global xss_clean filer al you need to do is this:

Code:

$company_name = $this->input->post('company_name', TRUE);  // turn on xss_clean for input->post

[eluser]Dandy_andy[/eluser]
[quote author="InsiteFX" date="1393617994"]You do not need to turn on the global xss_clean filer al you need to do is this:

Code:

$company_name = $this->input->post('company_name', TRUE);  // turn on xss_clean for input->post

[/quote]

But what if you've already turned on global filter and don't want to go through your entire site finding the post attributes? That's why I did what I did!

[eluser]InsiteFX[/eluser]
Search - find and replace in project Gee.