Protected Tags

[Shaun]

Reading from this page, ​http://docs.cksource.com/ckeditor_api/symbols/CKEDITOR.config.html#.protectedSource

If I understand correctly, you must have

config.protectedSource.push( /<\?[\s\S]*?\?>/g ); // Allows PHP Code

in your config to be able to use PHP code within the editor.

However, if I load the editor, switch to Source mode, type some simple PHP:

<?php echo 'Whatever I want.'; ?>

and submit, CKEditor does not entitize or remove the PHP code and it goes through unscathed.

This means I have to manually check for PHP code upon submission.

Correct me if I'm wrong, but I believe that is a bug.

[Shaun]

Forgot to add, although I believe its implied, that I do NOT have

config.protectedSource.push( /<\?[\s\S]*?\?>/g ); // Allows PHP Code

enabled in my config.

[Alfonso Martínez de Lizarrondo]

protectedSource is meant to be used to handle data that otherwise would be destroyed by the editing system or the browser. It is not any kind of clean up or sanitizing system, you must do it yourself at the server.

[Shaun]

Thanks for the explanation.

Perhaps that should be clarified in the API docs.