CKEditor - turn off autoescaping judiciously for Javascript?

Using Django
1

Another problem with CKEditor is that you have to turn off auto escaping in your template for it to display the HTML it has generated.

  {{article.intro|safe}}

However, you can then embed JavaScript directly into the fields of your model in HTML, which obviously isn’t ideal.

Any suggestions to overcome these problems? I’m starting to get cold feet on CKEditor. I like it, just don’t think it’s quite there yet.

I assume other people are using CKEditor in live apps, and wondering how they are overcoming these hurdles?

Yes - I do not trust my users to not inject Javascript into their blog-posts. :smile: I would, probably.

2

That’s an issue with all editors generating HTML. You should post-process the HTML on the serverside to ensure that script tags etc. are removed from the source. There are various solutions for this:

There are other solutions of course.

1 Like
3

Thanks, your project looks very promising. I notice you do a CMS, too. Looks very interesting. I’ll be checking it out shortly. I might need to use a Django based CMS soon.

1 Like