When using the data with the database, remember to
escape the data using the database object's Quote() method.
If you want to allow your users to submit formatted data, you may want to consider
using BBCode (Bulletin Board Code). BBCode is a simple markup language that uses
a similar format to XHTML. Commonly used on forums, the language allows us to
give the user the power to format their data without the worry of XSS. There are all
sorts of BBCode tags; exactly how they are rendered may differ.
BBCode XHTML Example
[b]Bold text[/b]
Bold text Bold text
[i]Italic text[/i]
Italic text Italic text
[u]Underlined text[/u]
Underlined text Underlined text
:)

[quote]Some quote[/quote]
Some quote
Some quote
Error Handling and Security
[ 332 ]
Joomla! does not include any BBCode-parsing libraries. Instead we must either build
our own parser or include an existing library. One such BBCode library is a class
available from http://www.
Pages:
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461