EE 2.6.1 WYGWAM 2.7.1

I have a Wygwam field. Inline image tags are not being written properly when entered through a Safecracker form. Inline image tags ARE being written properly when entered through the EE CP.

From the control panel, an img tag is written thusly:

<img alt=”” data-cke-saved-src=“something.jpg” src=“something.jpg” style=“width: 110px; height: 150px;”>

And from Safecracker, it looks like this:

<img alt=”” data-cke-saved-src=“something.jpg” src=“something.jpg” 110px;=”” height:=”” 150px;”=”“>

The style attribute is not encoding properly.

Andris over at P&T points us to line 1302 in safecracker_lib.php and suspects “the Security library is somehow deciding that style attribute is an XSS attack and is handling it rather poorly”

Is there something I can be doing to fix this?

I’ll gladly accept a patch if anyone can help. This is kind of a big deal. Thanks.

(I see a few answers that mention editing CKEditor config files. Ugh... really?)

1 Answer 1


In safecracker_lib.php around line 2625, there's a blank array being defined called $this->skip_xss_fieldtypes. Add wygwam to that array.

$this->skip_xss_fieldtypes = array('wygwam');

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.