The forum operates in read-only mode. Please head to StackOverflow for support.

Tue, 10/09/2007 - 17:19

benkunz

Joined: 09/10/2007

Posts: 4

single quote not encoded

Hi,

when I get the content of the editor via the post method, I notice that double quote, &, > and < are encoded to " or & ... but the single quote is not encoded. I'd like to have it encoded too. Of course I could a dirty search and replace in the output but I'd rather do this nicely and change what has to be changed at the right place. If anyone knows where to do the change, I'd appreciate it...
PS : I use PHP 4.

thanks in advance

Wed, 10/10/2007 - 13:19

wiktor

Joined: 16/07/2007

Posts: 1641

Re: single quote not encoded

You are probalby using htmlspecialchars to encode HTML tags, check PHP manual for ENT_QUOTES option.
http://php.net/manual/en/function.htmlspecialchars.php

Wiktor Walc
CTO, CKSource - http://cksource.com
--
Follow CKEditor on: Twitter | Facebook | Google+

Wed, 10/10/2007 - 13:26

benkunz

Joined: 09/10/2007

Posts: 4

Re: single quote not encoded

I've solved the problem. it was not a php issue but a JS issue as it is JS that transfroms special html characters.
I simply add a new transformation rule in fckeditor\editor\js\fckeditorcode_gecko.js and fckeditorcode_ie.js that reads : "'":"#039". I added this next to '"':'quot' in the files.
hope this can help somone else some day

Tue, 09/09/2008 - 17:23

100it

Joined: 14/08/2008

Posts: 6

Re: single quote not encoded

Works!

Don't know why or how this got in there... :shock:

You could also use:

"'":"apos",

instead for clarity?

Regards.
C.

Tue, 09/09/2008 - 19:37

a.m.

Joined: 20/04/2008

Posts: 256

Re: single quote not encoded

You guys are relying on client-side code to encode single quotes for you. If this is your only defense against SQL injection, you are in danger. Do a little test - disable JS in your browser, which will disable FCK editor and submit text containing a single quote. If you end up with broken SQL, you are vulnerable. If your server code handles single quotes, all this editing is redundant.

100IT wrote:"'":"apos",

Note that ' is only valid in XML and XHTML, but not in HTML.

Fri, 09/12/2008 - 23:22

100it

Joined: 14/08/2008

Posts: 6

Re: single quote not encoded

Thanks A.M. you've got a point, sure. And for me Sql injectionsproblems are dealt with in php (using the common functions) On the other hand I also use php to print jsondata(containing fckcontents) from sql, which I'm feeding into a javascript object (variable) which gets broken if a single quote passes.

so why if double quotes get encoded in fckeditor, single quotes aren't? Thanks for remembering me of apos not being html.

Regards,
Chris.

Mon, 02/11/2013 - 12:16

(Reply to #6) #7

ArunKumar.P

Joined: 11/02/2013

Posts: 1

same problem i am not getting where u added #039

Dear Benkunz,

Basic environment is JSP technology.

I am also using fck editor in my application as you said i need more clarity on this because there are so much confusing in JS because of long code (fckeditorcode_geko.js and ie.js) kindly give me some idea on it.

One more can you tell me how to upload image in fckeditor.

Thanks, Arun