I'm planning to create a website to let people edit/customize their stories.
Let's say the stories will store a lot of html tags ( paragraph, images & video )
- After user finish editing the html / customize their stories
- My PHP code will
file_put_contentsto directory as
- While file_put_contents, my php code will strip
onload,onclick,etcon the html that POST to server.
- When other public user view the stories, my system will file_get_contents of the html.
May I know this approach is it safe?
I wanted to save as
.html it's because I'm trying to avoid query on database and straight away load the
.html, may be this will be faster on previewing the stories.
I'd some research on is it only way to store the stories(HTML), is to :
separate the html tags / paragraph / images into JSON format
then POST to backend > sanitize > strip all tag > send to database
- when public user view, need to connect database > retrieve the JSON text > then convert/render it to readable html format?