Member Avatar for pooran.c

What is the use of tiny mce javascript library ?
I m working on jsp project were it uses tinymce.js . i actullay dont know what it does .

  • 3 Contributors
  • 4 Replies
  • 265 Views
  • 1 Hour Discussion Span
  • Latest Post Latest Post by cereal

Dani AI

Generated

As and observed, TinyMCE is the client-side rich-text editor that replaces a textarea in the page. To answer ’s follow-up: it does not change how HTML forms submit to the server, but there are two practical points to watch for in a JSP/Servlet app — keeping the editor content synchronized with the underlying form field, and sanitizing HTML on the server.

Example (syncing editor content back into the textarea before submit):

<form id="postForm" action="SavePost" method="post">
  <textarea id="body" name="body"></textarea>
  <input type="submit" value="Save">
</form>

<script src="/path/to/tinymce.min.js"></script>
<script>
tinymce.init({ selector:'#body', plugins:'link image', toolbar:'bold italic | link image' });

// If using inline editors or custom submit, copy content back into the textarea:
document.getElementById('postForm').addEventListener('submit', function(){
  var ed = tinymce.get('body');
  if (ed) document.getElementById('body').value = ed.getContent();
});
</script>

Server-side: never trust client filtering. For Java, use a sanitizer (for example the OWASP Java HTML Sanitizer) to allow only the tags/attributes that are safe. Example pattern:

import org.owasp.html.PolicyFactory;
import org.owasp.html.Sanitizers;

String raw = request.getParameter("body");
PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
String clean = policy.sanitize(raw);
// store 'clean' via PreparedStatement into a TEXT/CLOB column

Extra tips: configure TinyMCE to limit plugins and allowed elements where possible, disable script-related features, handle image/file uploads with a secure server endpoint, set a Content-Security-Policy header, and always render only sanitized HTML (or escape it) in responses.

Recommended Answers

All 4 Replies

Member Avatar for pritaeas

It transforms a regular textarea in HTML into a full blown editor, similar to the one you typed this post in.

Member Avatar for cereal

Hi, it's a WYSIWYG text editor for HTML pages: http://www.tinymce.com/

Member Avatar for pooran.c

Does it any help in form submission ??

Member Avatar for cereal

If you refer to filtering:

Protection against XSS attacks needs to be done on the server since if you can submit contents in a form using TinyMCE one could as easily disable all javascript and there for bypass TinyMCE filtering and still submit HTML code with insecure content. You need to properly filter the HTML input on the server using things like HTMLPurifier etc.

But even if you use the bundled filtering, this is limited to the textarea, not to other input fields.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.