I have been trying to figure out how to allow html markup in the users profile fields. Many of my users have a "bio" field that contains biographical citations, which should be formatted in italics. They were escaped on output so the html tags were showing.
If you want to allow your profile fields to display the html instead, modify views_profile.inc to:
/**
* Default display method for a profile field
*/
function views_handler_field_profile_default($fieldinfo, $fielddata, $value, $data) {
$value = (unserialize($value) === false) ? $value : unserialize($value);
- return check_plain($value);
+ return $value;
}
Now I can do markup in the fields. Of course, now I HAVE to do markup in the fields for quotes, etc.
Is there any way to override this function or handler without mucking around in the views_profile.inc, for example by adding code to my templates template.php?
Comments
by taking out the
by taking out the check_plain, you're opening up a lot of security risks though right?
I don't know much about this, but wouldn't replacing it with check_markup allow the html but still give you some protection from xss or whatever?
Could use filter_xss as well
Could also use filter_xss (with the extra parameter to specify what tags should be allowed), but I would definitely use something to make sure there is no bad user output.
Dave