I'm planning to create a website to let people edit/customize their stories.

Let's say the stories will store a lot of html tags ( paragraph, images & video )

I'm thinking using some javascript plugins to let user edit their html, upload images & etc.

  1. After user finish editing the html / customize their stories
  2. My PHP code will file_put_contents to directory as stories-un1qu3-123.html
  3. While file_put_contents, my php code will strip <script> tag, and onload,onclick,etc on the html that POST to server.
  4. When other public user view the stories, my system will file_get_contents of the html.

May I know this approach is it safe?

I wanted to save as .html it's because I'm trying to avoid query on database and straight away load the .html, may be this will be faster on previewing the stories.

I'd some research on is it only way to store the stories(HTML), is to :

  1. separate the html tags / paragraph / images into JSON format

  2. then POST to backend > sanitize > strip all tag > send to database

  3. when public user view, need to connect database > retrieve the JSON text > then convert/render it to readable html format?


1 Answer 1


May I know this approach is it safe?

No, this is not safe as you're trying to strip tags. Rather than using a black list I recommend you'd use a white list approach. The white list defines which HTML tags users are allowed to use.

By only stripping <script> tags and the javascript on-events is not sufficient.

What will happen if I enter the following payload:


Your code will detect the <script>, alert and </script> tags in my payload and remove it. The result will be (XSS):

<script>alert('xss')</script> and this will "pop".

Try not to reinvent the wheel here. I'm sure there are relatively safe scripts on the internet that can do this as you're not the first person to use functionalities like this. Have a look at http://htmlpurifier.org/ to get some idea's.

In addition, I'd recommend looking in to a secure PHP framework as a basis for your application to avoid other common security problems such as SQL injection and Cross Site Request Forgery.

  • 2
    I'd go further and implement a restrictive CSP to disable remote and inline javascript and other badness
    – symcbean
    Mar 7, 2016 at 16:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .