<p>The reason there is a "Purify HTML?" setting only for Rich Text fields is that Twig will automatically escape the output of every other field by default, mitigating XSS attack vectors.</p>

<p>Rich Text fields, by nature, are designed to store HTML, therefore their output isn't escaped and you have to rely on things like "Purify HTML?" (which uses <a href="http://htmlpurifier.org/" rel="nofollow noreferrer">http://htmlpurifier.org/</a>) to try and remove anything malicious looking.</p>

<p>If you're plugin needs to output data for a Plain Text field in a way that doesn't get escaped (for whatever reason), you can always <a href="https://github.com/pixelandtonic/Craft-Release/blob/master/app/fieldtypes/RichTextFieldType.php#L205-L214" rel="nofollow noreferrer">run HTMLPurifier on it</a> manually.</p>

CC BY-SA 3.0
2016-12-14T09:14:42.957Z
I'm a bit confused. If Twig automatically escapes the values of every other field.. then how did this XSS attack happen? Is it because the values aren't escaped on input and thus saved 'unescaped' in the database?
Jan Van Echelpoel
CC BY-SA 3.0
2016-12-15T03:29:12.670Z
I've got no idea what your plugin is doing or how it's outputting that data, but  all escaping is done on output, not input.
Brad Bell
CC BY-SA 3.0
2016-12-15T08:36:25.333Z
The plugin basically just shows data gathered by a form. This form has a textfield 'name'. The attacker entered all kinds of JavaScript like `alert(123456)` inside the 'name' textfield which caused the JS code/alert to be executed when I visited the plugin page where all the data is shown in the back-end. So why did the code execute if Twig automatically escapes the outputs of plain text fields?
Jan Van Echelpoel
CC BY-SA 3.0
2016-12-15T23:45:01.940Z
Check the template where you're displaying the data on the plugin page.  Maybe you're outputting it with `|raw`?
Brad Bell
CC BY-SA 3.0
2016-12-16T09:16:05.800Z
No just `{{ a_variable }}`.. Guess it's best to implement more checks on the entered values before putting it into sessionStorage, like html-encoding with jQuery.
Jan Van Echelpoel
CC BY-SA 3.0
2016-12-13T19:01:10.450Z
2017-01-12T22:33:04.147Z
2017-01-12T22:33:04.147Z
Brad Bell
<p>Recently we've had someone/something trying to perform a XSS attack using a form which saves all data into sessionStorage and then sends it to a custom craft plugin to pair it with a user.</p>

<p>A solution to stop these XSS vulnerabilities from craft docs is to "enable all “Purify HTML?” Rich Text field settings" but I've noticed this option only exists for <strong>Rich Text</strong> fields.</p>

<p>So my question is, is it somehow possible to activate "Purify HTML" on plain text fields (and other types of input like select and checkboxes)? Or do I need to escape/encode these fields on the client side (and how)?</p>

<richtext><security>
"Purify HTML" on plain text fields
# "Purify HTML" on plain text fields

(Asked by: username_0 on 2016-12-13)

Recently we've had someone/something trying to perform a XSS attack using a form which saves all data into sessionStorage and then sends it to a custom craft plugin to pair it with a user.

A solution to stop these XSS vulnerabilities from craft docs is to "enable all “Purify HTML?” Rich Text field settings" but I've noticed this option only exists for **Rich Text** fields.

So my question is, is it somehow possible to activate "Purify HTML" on plain text fields (and other types of input like select and checkboxes)? Or do I need to escape/encode these fields on the client side (and how)?

**Tags:** richtext, security

---

## 1 answers

### Answer by username_1 on 2016-12-13. Score: 1

The reason there is a "Purify HTML?" setting only for Rich Text fields is that Twig will automatically escape the output of every other field by default, mitigating XSS attack vectors.

Rich Text fields, by nature, are designed to store HTML, therefore their output isn't escaped and you have to rely on things like "Purify HTML?" (which uses <http://htmlpurifier.org/>) to try and remove anything malicious looking.

If you're plugin needs to output data for a Plain Text field in a way that doesn't get escaped (for whatever reason), you can always [run HTMLPurifier on it](https://github.com/pixelandtonic/Craft-Release/blob/master/app/fieldtypes/RichTextFieldType.php#L205-L214) manually.

> **Comments:**
> **username_0**: I'm a bit confused. If Twig automatically escapes the values of every other field.. then how did this XSS attack happen? Is it because the values aren't escaped on input and thus saved 'unescaped' in the database?  
> **username_1**: I've got no idea what your plugin is doing or how it's outputting that data, but  all escaping is done on output, not input.  
> **username_0**: The plugin basically just shows data gathered by a form. This form has a textfield 'name'. The attacker entered all kinds of JavaScript like `alert(123456)` inside the 'name' textfield which caused the JS code/alert to be executed when I visited the plugin page where all the data is shown in the back-end. So why did the code execute if Twig automatically escapes the outputs of plain text fields?  
> **username_1**: Check the template where you're displaying the data on the plugin page.  Maybe you're outputting it with `|raw`?  
> **username_0**: No just `{{ a_variable }}`.. Guess it's best to implement more checks on the entered values before putting it into sessionStorage, like html-encoding with jQuery.  

---

