Security issues with CKEditor

CKEditor is a visual editing tool that, when committed, is "HTML code" on the server side of the post,

Although some unsafe code is automatically filtered in "WYSIWYG" mode on the client side, it does not guarantee that the server is receiving secure HTML code, does ckeditor provide a server-side HTML filtering tool?

Reply to discussion (solution)

The data submitted by the client is not always reliable, and it is necessary for the server to do some validation.

Does the ckeditor provide a server-side HTML filtering tool?
Want to know whether the plug-in has a function, then you have to look at its source code, the analysis will know,
But you still have to check the service side, to avoid the presence of bugs.

Thanks to the upstairs two-bit answer, it is true that server-side detection is performed. The key is how to ensure the integrity of HTML elements?

For example: Users upload non-standard HTML code, such as:

123

456789

Aaa

The code and the system's original code mix may be messed up, but you can't disable these HTML code, they may be a picture, a link or some style, how to avoid this situation?

If on the server side also to do this kind of processing, feel is to do a system, the difficulty is very big Ah, please expert advice ~ ~ ~

What labels should be filtered on the server side? Like what:






What else has to be filtered???

CKEditor where is the file code to be filtered when converting from Sourse mode to Wusiwug mode? Have to know the master please say Ah, thank you ~ ~ ~

