using Ajax to save contents of html how to make safe

Question

I am using com_Ajax to save the contents of my editor (front end of the website in a module)

Ajax and passing the content of the editor all works fine. I am concerned about security.

To get the data (in the helper) I use:

$params = $input->get('params',"",raw );

If I use just

$params = $input->get('params');

it strips all the html tags and so is useless for saving.

I looked up the filters but there seems to be nothing to make the raw data safe.

I'm saving it using:

$profile = new stdClass();
$profile->params= $params;

$result = $result = JFactory::getDbo()->insertObject('#__myTable', $profile);

Which works fine.

Using this, is the data safe for insert into the database since I'm using the abstract api for the database or do I need to do something else.

Answer 1

On the SQL side, data inserted using JDatabaseDriver::insertObject() and JDatabaseDriver::updateObject() methods is escaped automatically.

On HTML side, you should filter user input to prevent XSS. Normally, Joomla\CMS\Component\ComponentHelper::filterText() is used to filter content where HTML is allowed. These filters can be configured per user group in Global Configuration. Another option is to use default HTML filter:

$params = $input->get('params', '', 'html');