Ggtcf

Hi and thanks for reading.

I work on CodeIgniter 3 with PHP 7.0, and use forms with the form_helper.

First I had problems to re-populate the form with the set_value function, after using the form_validation library in my controller. I was using the set_value in my form_helper like this :

$my_input = array(
 'name' => 'my_name',
 'value' => set_value('my_name')
);
echo form_label('Title :');
echo form_textarea($my_input);

So with some text like this :

she's the chief's lady

The form was re-populated like this :

she's the chief's lady

It's not a big problem, because when I register this data and fill in a field, in HTML it will produice the right sentence.

BUT if there is another mistake in the form, then the sentence will be register like this :

she's the chief's lady

and now my data is not right anymore.

So I read the CodeIgniter's DOC and found this :

The third (optional) parameter allows you to turn off HTML escaping of
the value, in case you need to use this function in combination with
i.e. form_input() and avoid double-escaping.

So great, I solved my escaping problem. But what about xss injection ? This practice seems very dangerous, I don't understand why it's the best way, if I trust the CodeIgniter's DOC (I made a quick test with an alert script and the security failled). So :

1) What's the best way to keep safe, and to avoid escaping when I have to re-populate a form ???

2) The only person seeing the evil input is the one who has written it, but is it still dangerous for my web application or not ???

3) And if there's no danger when re-populate a form with the data sent, why do we need to set the escaping parameter to FALSE in set_value() ? Why the default value is not set to FALSE ?

EDIT : I added the 2 last questions

CodeIgniter will safely prevent SQL injection when anything goes into its models. As you’re just displaying the result in the browser, there’s not an injection risk as all you’re doing is displaying what they’ve written back to them.

But, you have a good point about JavaScript, or another tag. Assuming that the only person that can get to the input box is the author of its contents, and that you are escaping the results of it when it’s viewed by other people, then the only person they can ever produce an alert box (or worse) for is themselves, which of course they can do anyway in the console.

If you were still worried, you could always use PHP’s strip_tags() on this field.