Search code examples
javascriptphpjqueryajaxfat-free-framework

Why $_POST is removing HTML tags from string?


I'm on PHP 5.6 using the Fat Free Framework (if it matters) and having a weird issue. I am sending form data to the server like so:

function submitForm(form) 
{
    var fd = new FormData();
    var file_data = isImageIncluded ? $('input[type="file"]')[0].files : [];
    for (var i = 0; i < file_data.length; i++) {
        fd.append("file_" + i, file_data[i]);
    }
    var other_data = $(form).serializeArray();
    $.each(other_data, function(key, input) {
        fd.append(input.name, input.value);
    });

    sendData(url, fd, form);
}

function sendData(url, data, form) 
{
    $.ajax({
        type: 'POST',
        url: url,
        data: data,
        contentType: false,
        processData: false,
        success: function(data) {
            console.log(data);
        }
    }
});

}

So as I debug the code above, I see the data being sent from the wysiwyg with html tags like <b></b>.

The problem is on the PHP side. Here's the method:

public function editRelease()
{
    var_dump($_POST['description']);exit;
}

And cannot get the description to show the html tags in the string. Does anyone have an idea on what's happening?

EDIT

Here's a screenshot of my headers from Chrome. I marked the object I'm referring to. As it shows, the html tags are going to the server, so I'm not sure why it's not showing in the $_POST array.

screenshot

EDIT 2

And here is a screenshot of the response I get corresponding to the screenshot of the headers above: enter image description here

Has anyone ever seen this?


Solution

  • For those wondering, I found out that in my variation of the Fat Free Framework, called F3 Boilerplate, there was a section of code stripping the tags out. Inside of its app.php, I found

    // clean ALL incoming user input by default
    $request = array();
    foreach (array('GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'COOKIE') as $var) {
        $input = $f3->get($var);
        if (is_array($input) && count($input)) {
            $cleaned = array();
            foreach ($input as $k => $v) {
                $k = strtolower(trim($f3->clean($k)));
                $v = $f3->clean($v);
                if (empty($v)) {
                    continue;
                }
                $cleaned[$k] = $v;
                $request[$k] = $v;
            }
            ksort($cleaned);
            $f3->set($var, $cleaned);
        }
    }
    

    which removes tags from all incoming input using $f3->clean() so I had to modify it to whitelist tags as explained in the documentation http://fatfreeframework.com/base#clean.