Plugins, Hooks, & External Modules
Developer methods for
Plugins, Hooks, & External Modules
Hook functions
REDCap Developer Tools:
Documentation for Plugins, Hooks, & External Modules
REDCap Version 14.9.1
REDCap::filterHtml
(REDCap >= 5.11.0)
REDCap::filterHtml
— Filters a string of text to remove any potentially harmful HTML tags or potentially harmful attributes inside allowable HTML tags
Description
string REDCap::filterHtml ( string $string )
Filter a string of text to remove any potentially harmful HTML tags (e.g., <script>, <embed>) or potentially harmful attributes inside allowable HTML tags (e.g., <a onclick="..." onselect="...">...</a>). The main application of this method is for outputing to a webpage some text that may contain HTML, in which you wish for all the HTML tags to be interpreted properly by the web browser while removing any potentially harmful tags that might exist in the text, such as <script>, which can be used maliciously for attempting Cross-site Scripting (XSS). If any allowable HTML tags, such as <a>, contain attributes deemed potentially harmful, it will not remove the whole HTML tag but instead will only remove the attribute from inside the tag.
NOTE: The HTML tags that are allowable and will NOT get filtered from the text are <label><pre><p><a><br><br/><center><font><b><i><u><h3><h2><h1><hr><table><tr><th><td><img><span><div><em><strong><acronym>.
NOTE: The HTML tags that are allowable and will NOT get filtered from the text are <label><pre><p><a><br><br/><center><font><b><i><u><h3><h2><h1><hr><table><tr><th><td><img><span><div><em><strong><acronym>.
Parameters
string
Text string to be filtered.
Text string to be filtered.
Return Values
Returns the filtered string.
Examples
Example #1:
This example shows how to print a string of text on a webpage so that allowable HTML tags get interpreted properly by the browser while potentially malicious tags are filtered out. The output of the example below should be the following:Here's my bold text. Attempt to perform cross-site scripting with alert('XSS successful!')
// Set the text value
$text = "Here's my <b>bold</b> text. Attempt to perform cross-site scripting
with <script>alert('XSS successful!')</script>";
// Filter the text and output it to the webpage
print REDCap::filterHtml($text);
REDCap 14.9.1 - © 2024 Vanderbilt University