0

Does Bolt have any built-in data purification?

I have several front-end forms which create content type records on the back-end. These are then later output to the front-end of the website. I was wondering whether Bolt had any built in parsers I could use to purify the input?

If not I will add HTML Purifier to my extension processing the forms.

Cheers.

diggersworld
  • 12,770
  • 24
  • 84
  • 119

2 Answers2

0

I have only touched lightly on this myself and someone might have a better idea. But Bolt bundles Symfony Forms, so you can use the functionality provided there.

How it's done in the SimpleForms extension is a good starting place.

Gawain
  • 1,568
  • 10
  • 8
  • I'm using simpleforms. However if I add javascript to my input it's still there when I pass the data on for storage (after being through the simpleforms processing function). So when it's output to the user facing side, it renders as valid HTML and runs whatever script is there. – diggersworld Aug 27 '14 at 12:05
0

That depends on how you work with your forms.

Bolt uses twig, and twig has some builtin stuff to cleanup the input, like {{ var|escape }}. http://twig.sensiolabs.org/

You can build an extension that provides the forms, and in that extension you can use all of the validation methods in the symfony form components or whatever you throw at it in php before you store the form values. But you need to configure it all yourself.

If you use the simpleforms extension most of that will be done for you. In that case some filtering is done on the form input, but what happens with it will be up to you again.

If you just create some plain forms in HTML and add those to your template or content there is no filtering, and you need to do that (serverside) in the script that handles the form.

jadwigo
  • 339
  • 1
  • 9
  • Please see my response to Gawain. – diggersworld Aug 27 '14 at 12:07
  • Unfortunately the Simpleforms extension at the moment does not do all the validation that would be needed for that. This means you will have to cleanup the data before you output it inn your templates. This will improve someday, after some more work is done on the extension. – jadwigo Aug 29 '14 at 13:05
  • Cool, that's what I though. Always nice to have a second set of eyes on something. Cheers. – diggersworld Aug 29 '14 at 13:40