htmlPurifier not working with TinyMCE

htmlpurifier, tinymce, xss

Solution

I think i found what was wrong.

tinyMCE automatically encode entities such:

< into &lt;
> into &gt;
" into &quot;
& into &amp;

I tried to use diferent types of entity_encoding on tinyMCE but none of them seems to work as i want, so i used PHP: html_entity_decode to decode tinyMCE text area and then i used htmlPurifier to sanitize the data and everything works ok now.

Hope someone else find this usefull.

Problem

I´m using htmlPurifier to prevent XSS Attacks from users and everything works ok on input type="text" fields. But, when i try to clean tinyMCE textareas seems like htmlPurifier don´t work, ex.: Simple input text field Input.: ``` <script>alert("XSS")</script>Cleaning Test ``` Output: Cleaning Test tinyMCE TEXTAREA Input.: ``` <script>alert("XSS")</script> ``` Output: `<script>alert("XSS")</script>` Did i miss something ? Why htmlPurifier work on a simple input text and with tinyMCE textarea don´t ? Ps.: Magic Quotes are Off

Original source