I am using com_Ajax to save the contents of my editor (front end of the website in a module)

Ajax and passing the content of the editor all works fine. I am concerned about security.

To get the data (in the helper) I use:

$params = $input->get('params',"",raw );

If I use just

$params = $input->get('params');

it strips all the html tags and so is useless for saving.

I looked up the filters but there seems to be nothing to make the raw data safe.

I'm saving it using:

$profile = new stdClass();
$profile->params= $params;

$result = $result = JFactory::getDbo()->insertObject('#__myTable', $profile);

Which works fine.

Using this, is the data safe for insert into the database since I'm using the abstract api for the database or do I need to do something else.


On the SQL side, data inserted using JDatabaseDriver::insertObject() and JDatabaseDriver::updateObject() methods is escaped automatically.

On HTML side, you should filter user input to prevent XSS. Normally, Joomla\CMS\Component\ComponentHelper::filterText() is used to filter content where HTML is allowed. These filters can be configured per user group in Global Configuration. Another option is to use default HTML filter:

$params = $input->get('params', '', 'html');

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.