How to prevent JavaScript injection, but provide a ckeditor with code formatter

Question

I have created a website based on

SQL Server 2014
C# (ASP.NET)
Javascript and jQuery

The user can store information within a textbox on my site. To prevent injection, I can use encode / decode from special character. The user should be able to submit code like below but the code should not executed. So far so good.

<script type="text/javascript">
    $(document).ready(function () {
        console.log('uuuuups.....');
    });
</script>

This code will be stored as is to database. (without encoding first). Now I would like to offer a ckeditor to my users and give the ability to use the code-plugin. The code-plugin itself creates the following code:

<pre class="brush:jscript;">
&lt;script type=&quot;text/javascript&quot;&gt;
    $(document).ready(function () {
        console.log(&#39;uuuuups....&#39;);
    });
&lt;/script&gt;</pre>

I have tried to replace charcter within SQL like

replace(replace(@text, '<', '&lt;'), '>', '&gt;')

But this seems to break the code when I try to view. My problem now is, how to handle this? Do I have encode twice? Every hint will be appreciated.

You may think about somthing like Sanitize HTML: github.com/gbirke/Sanitize.js for example — Stefan Brinkmann
– Stefan Brinkmann, Commented Jun 3, 2016 at 7:31

Hadi Kanaan. · Accepted Answer · 2017-08-19 10:19:48Z

0

i am using ckeditor in my web site, and i face the same issue, it is about javascript injection. how to prevent it without disrupting the view. Try in your server side to parse the "< script ...>javascript code ...</script>" and clear it. I think it is not difficult to find this tag in asp.net nor in php.

Good luck

edited Aug 19, 2017 at 10:19

answered Aug 19, 2017 at 9:45

Hadi Kanaan.

11 bronze badge

Sign up to request clarification or add additional context in comments.

1 Comment

Vishal Over a year ago

Kindly provide code snippet/detailed answer for it to help!

Collectives™ on Stack Overflow

How to prevent JavaScript injection, but provide a ckeditor with code formatter

1 Answer 1

1 Comment

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Linked

Related