single quote not encoded

Hi,

when I get the content of the editor via the post method, I notice that double quote, &, > and < are encoded to " or & ... but the single quote is not encoded. I'd like to have it encoded too. Of course I could a dirty search and replace in the output but I'd rather do this nicely and change what has to be changed at the right place. If anyone knows where to do the change, I'd appreciate it...
PS : I use PHP 4.

thanks in advance

Wed, 10/10/2007 - 13:19

wiktor

Joined: 16/07/2007

Posts: 1641

Re: single quote not encoded

http://php.net/manual/en/function.htmlspecialchars.php

Wiktor Walc
CTO, CKSource - http://cksource.com
--
Follow CKEditor on: Twitter | Facebook | Google+

Wed, 10/10/2007 - 13:26

benkunz

Joined: 09/10/2007

Posts: 4

Re: single quote not encoded

Tue, 09/09/2008 - 17:23

100it

Joined: 14/08/2008

Posts: 6

Re: single quote not encoded

Tue, 09/09/2008 - 19:37

a.m.

Joined: 20/04/2008

Posts: 256

Re: single quote not encoded

You guys are relying on client-side code to encode single quotes for you. If this is your only defense against SQL injection, you are in danger. Do a little test - disable JS in your browser, which will disable FCK editor and submit text containing a single quote. If you end up with broken SQL, you are vulnerable. If your server code handles single quotes, all this editing is redundant.

100IT wrote:"'":"apos",

Note that ' is only valid in XML and XHTML, but not in HTML.

Fri, 09/12/2008 - 23:22

100it

Joined: 14/08/2008

Posts: 6

Re: single quote not encoded

Thanks A.M. you've got a point, sure. And for me Sql injectionsproblems are dealt with in php (using the common functions) On the other hand I also use php to print jsondata(containing fckcontents) from sql, which I'm feeding into a javascript object (variable) which gets broken if a single quote passes.

so why if double quotes get encoded in fckeditor, single quotes aren't? Thanks for remembering me of apos not being html.

Regards,
Chris.

Mon, 02/11/2013 - 12:16

(Reply to #6) #7

ArunKumar.P

Joined: 11/02/2013

Posts: 1

same problem i am not getting where u added #039

Dear Benkunz,

Basic environment is JSP technology.

I am also using fck editor in my application as you said i need more clarity on this because there are so much confusing in JS because of long code (fckeditorcode_geko.js and ie.js) kindly give me some idea on it.

One more can you tell me how to upload image in fckeditor.

Thanks, Arun