安企CMS（AnQiCMS）as a powerful content management system developed based on Go language, its flexible content model and customizable document parameter function provide great freedom for enterprises and content operators.This means we can create unique fields for articles, products, and other content based on actual needs to meet personalized display requirements.However, when these custom parameters need to carry rich text (i.e., content containing HTML tags), how to ensure that the content is rendered correctly while avoiding potential security risks has become a topic that we experienced operators must delve into.
This article will analyze in depth from the perspective of a senior website operation expert, how to use AnQiCMS safely and efficientlyarchiveParamsTags to render custom documents containing HTML content and provide practical operation strategies.
Flexible application and scenarios of AnQiCMS custom document parameters
One of AnQiCMS's core advantages lies in its 'flexible content model'.This feature allows users to define exclusive custom fields for different content types (such as articles, products, services, etc.).For example, you may need to add a "Technical Specifications" field to the "Product DetailsarchiveParamsLabel, we can easily retrieve and display these dynamically defined additional information in templates, greatly enriching the expression form of the content.
archiveParamsThe usage method of the label is usually as follows:
{% archiveParams params %}
{% for item in params %}
<div>
<span>{{item.Name}}：</span>
<span>{{item.Value}}</span>
</div>
{% endfor %}
{% endarchiveParams %}
Here,item.NameRepresents the name of a custom parameter, whileitem.Valueit carries the specific content of the parameter.
Potential risks of HTML rendering: Cross-Site Scripting (XSS)
In the Web world, directly outputting content containing HTML tags that are read from the database to the page is like opening Pandora's box. If these HTMLs unfortunately contain malicious JavaScript code (such as<script>alert('您的会话被劫持！')</script>These codes will be executed in the visitor's browser, leading to the notorious cross-site scripting (XSS) attack.XSS attack may steal user sensitive information, hijack user sessions, and even tamper with page content, posing serious threats to the credibility of the website and user safety.
Therefore, AnQiCMS defaults to strict security measures: All content output through template tags is automatically converted to HTML entities. This means that,item.Valuecontains<strong>重要信息</strong>，browser actually parses to this<strong>重要信息</strong>，not the bolded 'important information'. This default escaping mechanism is an important defense against XSS attacks.
archiveParamsLabel and Safe Rendering Practices of HTML Content in English
Understood the default security mechanism of AnQiCMS, we can then discuss how to "safely" remove this escaping when needed, so that HTML content can be rendered normally.