What do you do with html injections?

[eluser]Mr.Data[/eluser]
Hello!
The page I created contains almost everywhere some forms where the user can type in some content which is displayed afterwards. If someone types in some html code I don't want this code to be rendered but it should be cleaned by a php function like htmlentities(). It is possible that I manually add the htmlentities() function to each output but can't you do this globally? What do you do if you come into such a situation?

[eluser]CroNiX[/eluser]
Take a look at the form validation library.

[eluser]Mr.Data[/eluser]
The prepping functions of the form validation class only can be used to filter form content in order to save it later and not to display it. Moreover I can't see an option there to do it globally.

[eluser]CroNiX[/eluser]
I guess you missed reading the note right under the Prepping Functions section. You sure can display it without saving to the database. It's still stored in the post variable (the manipulated version if it passes validation). You're right, there isn't a default global option to do what you want.

[eluser]PhilTem[/eluser]
For user input: Prepare the post-variables to not contain any harmful code (use e.g. xss-filtering)

For user output: Easiest way is to use htmlentities to convert each character to its corresponding html-entity. & turns to &, ...
A more advanced approach is to use something like http://htmlpurifier.org because you have more control over how the original input data will be changed.

[eluser]Mr.Data[/eluser]
Would it be a solution to apply htmlentities to each element of the array you send to the view?
Something like this:

Code:

$data = ...; // everything which should be displayed within the view
$data = array_map('htmlentities',$data);  
$this->load->view('view', $data);

[eluser]PhilTem[/eluser]
That's the easiest method. But be careful with htmlentities' arguments. If you have set your pages' and datbase's charset to UTF-8 then you will get strange output from htmlentities since

If omitted, the default value for this argument is ISO-8859-1 in versions of PHP prior to 5.4.0, and UTF-8 from PHP 5.4.0 onwards

(from php.net)