I would like to use the RichText option on one of my web form fields in Form and List.

However, I'm not sure what the security advice is when using this field as it allows html to be inputted and files to be uploaded etc.

Our site is open to all the public with no login required, so what would be best security practice here?

I realise i could always just use a simple form field with the following validation string (to allow punctuation but not html tags) as one option.
^[A-Za-z0-9\-,.!"'£%&*()+=@;:\\/#~?\$ \s]{6,9000}$

there are filters added to prevent non-admins adding scripts or anonymous users to enter HTML at all. There is an extra module setting to increase filter level applied.

---

Cheers from Germany,
Sebastian Leupold

   

Speed up your DNN Websites with TurboDNN