cannot insert iframe in mysql db

Question

I am using kohana 2.3.4, I have a text area for "Embed Google Map Code", the system automatically strips the Iframe tag and not inserted on the database. here's my code snippet for inserting/updating:

$this->db->query("UPDATE tbl_sites SET map_code='$_POST[map_code]' WHERE id=$id");

score 0 · Answer 1 · edited May 23 '17 at 10:34

0

My guess is that you are forgetting the quotes when indexing into the $_POST array. Try this:

$this->db->query("UPDATE tbl_sites SET map_code='{$_POST["map_code"]}' WHERE id={$id}");

You should also make sure to sanitize the values coming from the $_POST array before using it in a query.

edited May 23 '17 at 10:34

Community

1
1

answered May 07 '12 at 22:30

JK.

5,126
1
27
26

ok thanks JK. Will try it now. I will just use the $this->input->post() of kohana. I will sanitize the values automatically – jalf May 07 '12 at 22:41
Still the same JK, iframe tag wont insert on the database – jalf May 07 '12 at 22:46
no error message. It successfully updated but the iframe tag is not inserted on the database – jalf May 07 '12 at 23:11

score 0 · Answer 2 · answered May 08 '12 at 10:03

That query looks dodgy, but if you're certain it's updating the record correctly, and Kohana is only stripping the iframe, then perhaps this is an issue with XSS filtering.. have you tried to turn off global XSS filtering? http://docs.kohanaphp.com/general/security#cross_site_scripting_xss

cannot insert iframe in mysql db

2 Answers2