title: Clean Text in FCKeditor textbox
body: <p>I have a legacy web application that I'm needing to migrate to a new Windows Server (to 2019 from 2008r2) and have been running into some security issues.  mainly with a rich text style textbox FCKeditor text box.  this editor adds html tags and if somebody copies from a Word doc to fill out the field, the hidden Word doc structures (xml and style content) is also brought over and thus the 2019 security throws an error message about the text being potentially hazardous.  I came up with a function to clean up the text content and bring it back to a plain text content.  however the security still throws an error and never makes it to the function i created.</p>
  
  <pre><code>protected string GetCleanedText(string content)
  {
  
      const string tagWhiteSpace = @"(&gt;|$)(\W|\n|\r)+&lt;"; 
      const string stripFormatting = @"&lt;[^&gt;]*(&gt;|$)"; 
      const string lineBreak = @"&lt;(br|BR)\s{0,1}\/{0,1}&gt;";
      const string xmlformatting = @"&lt;xml&gt;[\s\S]*?&lt;\/xml&gt;";
      const string styleformatting = @"&lt;style&gt;[\s\S]*?&lt;\/style&gt;";
      Regex lineBreakRegex = new Regex(lineBreak, RegexOptions.Multiline);
      Regex xmlformattingRegex = new Regex(xmlformatting, RegexOptions.Multiline);
      Regex stripFormattingRegex = new Regex(stripFormatting, RegexOptions.Multiline);
      Regex tagWhiteSpaceRegex = new Regex(tagWhiteSpace, RegexOptions.Multiline);
      Regex styleformattingRegex = new Regex(styleformatting, RegexOptions.Multiline);
  
      string text = content;
      //xml formatting
      text = xmlformattingRegex.Replace(text, string.Empty);
      //style formatting
      text = styleformattingRegex.Replace(text, string.Empty);
      //Decode html specific characters
      //text = System.Net.WebUtility.HtmlDecode(text);
      //text = System.Net.WebUtility.HtmlDecode(text);
      text = System.Web.HttpUtility.HtmlDecode(text);
      //Remove tag whitespace/line breaks
      text = tagWhiteSpaceRegex.Replace(text, "&gt;&lt;");
      //Replace &lt;br /&gt; with line breaks
      text = lineBreakRegex.Replace(text, Environment.NewLine);
      //Strip formatting
      text = stripFormattingRegex.Replace(text, string.Empty);
  
      return text;
  }
  </code></pre>
  
  <p>The data on the aspx page is set up with two way binding via <code>Bind()</code>.  I've tried replacing it with <code>Eval()</code> and calling the<code>GetCleanedText()</code> function to clean the text content, but the data continues to get wiped due to the <code>FormView1_ItemCreated()</code> function and either leaves the text box empty or doesn't allow the content to be updated.  I've also tried to implement stuff in the <code>ItemCreated</code>, <code>ItemUpdating</code>, and <code>FormView1_DataBound()</code> functions and still either get an emtpy text box or one that when <strong>Editing</strong> the text field doesn't maintain the new text content.</p>
  
  <p>here's the aspx page (I've removed most of the other content to focus on what I'm trying to fix):</p>
  
  <pre><code>&lt;asp:FormView ID="FormView1" runat="server" DataKeyNames="id" DataSourceID="ObjectDataSource1"
                              OnItemCreated="FormView1_ItemCreated" OnDataBound="FormView1_DataBound" OnItemUpdating="FormView1_ItemUpdating"
                              OnItemDeleting="FormView1_ItemDeleting" BorderWidth="0px" CssClass="nospace"
                              Width="100%" OnItemInserting="FormView1_ItemInserting" AllowPaging="True" EmptyDataText="No records found."&gt;
                              &lt;EditItemTemplate&gt;
                  &lt;table width="100%" border="0" cellpadding="2"&gt;
                      &lt;tr&gt;
                                          &lt;td&gt;
                                              &lt;b&gt;Business Reason for the Purchase:&lt;/b&gt;&lt;br /&gt;
                                              &lt;FCKeditorV2:FCKeditor ID="purchase_reasonTextBox" runat="server" BasePath="~/fckeditor/"
                                                  Height="150px" ToolbarSet="Request" Value='&lt;%# Bind("purchase_reason") %&gt;'&gt;
                                              &lt;/FCKeditorV2:FCKeditor&gt;
                                          &lt;/td&gt;
                                          &lt;td&gt;
                                              &amp;nbsp;
                                          &lt;/td&gt;
                                          &lt;td&gt;
                                              &lt;b&gt;Description of Product or Service:&lt;/b&gt;&lt;br /&gt;
                                              &lt;FCKeditorV2:FCKeditor ID="product_descriptionTextBox" runat="server" BasePath="~/fckeditor/"
                                                  Height="150px" ToolbarSet="Request" Value='&lt;%# Bind("product_description") %&gt;'&gt;
                                              &lt;/FCKeditorV2:FCKeditor&gt;
                                          &lt;/td&gt;
                                      &lt;/tr&gt;
                                      &lt;tr&gt;
                                          &lt;td&gt;
                                              &lt;asp:LinkButton ID="UpdateButton" runat="server" CausesValidation="True" CommandName="Update"
                                                  CssClass="btn" OnClientClick="RemoveDisplayMessage()" TabIndex="40" Text="Update"
                                                  ValidationGroup="requestgroup" /&gt;
                                              &amp;nbsp;&lt;asp:LinkButton ID="UpdateCancelButton" runat="server" CausesValidation="False"
                                                  CommandName="Cancel" CssClass="btn" OnClientClick="RemoveDisplayMessage()" TabIndex="42"
                                                  Text="Cancel" /&gt;
                                              &lt;asp:ValidationSummary ID="ValidationSummary1" runat="server" HeaderText="Please complete fields:"
                                                  ShowMessageBox="True" ShowSummary="False" ValidationGroup="requestgroup" /&gt;
                                          &lt;/td&gt;
                                          &lt;td align="right"&gt;
                                              &amp;nbsp;
                                          &lt;/td&gt;
                                          &lt;td align="right"&gt;
                                              &amp;nbsp;
                                          &lt;/td&gt;
                                          &lt;td align="right"&gt;
                                          &lt;/td&gt;
                                      &lt;/tr&gt;
                  &lt;/table&gt;
                  &lt;/EditItemTemplate&gt;
                              &lt;InsertItemTemplate&gt;
                                  &lt;table width="100%" border="0" cellpadding="2"&gt;
                                      &lt;tr&gt;
                                          &lt;td&gt;
                                              &lt;b&gt;Business Reason for the Purchase:&lt;/b&gt;&lt;br /&gt;
                                              &lt;FCKeditorV2:FCKeditor ID="purchase_reasonTextBox" runat="server" BasePath="~/fckeditor/"
                                                  Height="150px" ToolbarSet="Request" Value='&lt;%# Bind("purchase_reason") %&gt;'&gt;
                                              &lt;/FCKeditorV2:FCKeditor&gt;
                                          &lt;/td&gt;
                                          &lt;td&gt;
                                              &amp;nbsp;
                                          &lt;/td&gt;
                                          &lt;td&gt;
                                              &lt;b&gt;Description of Product or Service:&lt;/b&gt;&lt;br /&gt;
                                              &lt;FCKeditorV2:FCKeditor ID="product_descriptionTextBox" runat="server" BasePath="~/fckeditor/"
                                                  Height="150px" ToolbarSet="Request" Value='&lt;%# Bind("product_description") %&gt;'&gt;
                                              &lt;/FCKeditorV2:FCKeditor&gt;
                                          &lt;/td&gt;
                                      &lt;/tr&gt;
                                      &lt;tr&gt;
                                          &lt;td&gt;
                                              &lt;asp:LinkButton ID="InsertButton" runat="server" CausesValidation="True" CommandName="Insert"
                                                  CssClass="btn" OnClientClick="RemoveDisplayMessage()" TabIndex="42" Text="Insert"
                                                  ValidationGroup="requestgroup" /&gt;
                                              &amp;nbsp;&lt;asp:LinkButton ID="InsertCancelButton" runat="server" CausesValidation="False"
                                                  CommandName="Cancel" CssClass="btn" OnClientClick="RemoveDisplayMessage()" TabIndex="44"
                                                  Text="Cancel" /&gt;
                                              &lt;asp:ValidationSummary ID="ValidationSummary1" runat="server" HeaderText="Please complete fields:"
                                                  ShowMessageBox="True" ShowSummary="False" ValidationGroup="requestgroup" /&gt;
                                          &lt;/td&gt;
                                          &lt;td align="right"&gt;
                                              &amp;nbsp;
                                          &lt;/td&gt;
                                          &lt;td align="right"&gt;
                                              &amp;nbsp;
                                          &lt;/td&gt;
                                          &lt;td align="right"&gt;
                                          &lt;/td&gt;
                                      &lt;/tr&gt;
                                  &lt;/table&gt;
                              &lt;/InsertItemTemplate&gt;
                              &lt;ItemTemplate&gt;
                                  &lt;table width="100%" border="0" cellpadding="2"&gt;
                                      &lt;tr&gt;
                                          &lt;td colspan="2" valign="top"&gt;
                                              &lt;b&gt;Business Reason for the Purchase:&lt;/b&gt;&lt;br /&gt;
                                              &lt;asp:Label ID="purchase_reasonLabel" runat="server" Text='&lt;%# Bind("purchase_reason") %&gt;'
                                                  BackColor="#EFF2F3" BorderWidth="0" CssClass="textBlock" /&gt;
                                          &lt;/td&gt;
                                      &lt;/tr&gt;
                                      &lt;tr&gt;
                                          &lt;td colspan="2" valign="top"&gt;
                                              &lt;b&gt;Description of Product or Service:&lt;/b&gt;&lt;br /&gt;
                                              &lt;asp:Label ID="product_descriptionLabel" runat="server" Text='&lt;%# Bind("product_description") %&gt;'
                                                  BackColor="#EFF2F3" BorderWidth="0" CssClass="textBlock" /&gt;
                                          &lt;/td&gt;
                                      &lt;/tr&gt;
                                      &lt;tr&gt;
                                          &lt;td&gt;
                                              &lt;asp:LinkButton ID="EditButton" runat="server" CausesValidation="False" CommandName="Edit"
                                                  CssClass="btn" OnClientClick="RemoveDisplayMessage()" Text="Edit" /&gt;
                                              &amp;nbsp;&lt;asp:LinkButton ID="DeleteButton" runat="server" CausesValidation="False" CommandName="Delete"
                                                  CssClass="btn" OnClientClick="RemoveDisplayMessage(); return confirm('Do you really want to delete this item?');"
                                                  Text="Delete" /&gt;
                                              &amp;nbsp;&lt;asp:LinkButton ID="NewButton" runat="server" CausesValidation="False" CommandName="New"
                                                  CssClass="btn" OnClientClick="RemoveDisplayMessage()" Text="New" /&gt;
                                          &lt;/td&gt;
                                          &lt;td align="right"&gt;
                                              &lt;asp:LinkButton ID="ApproveButton" runat="server" CausesValidation="False" CommandArgument='&lt;%# Eval("id") %&gt;'
                                                  CommandName="Approve" CssClass="btn" OnCommand="StatusButton_Command" Text="Approve" /&gt;
                                              &amp;nbsp;&lt;asp:LinkButton ID="DenyButton" runat="server" CausesValidation="False" CommandArgument='&lt;%# Eval("id") %&gt;'
                                                  CommandName="Deny" CssClass="btn" OnCommand="StatusButton_Command" Text="Deny" /&gt;
                                              &amp;nbsp;&lt;asp:LinkButton ID="ReturnButton" runat="server" CausesValidation="False" CommandArgument='&lt;%# Eval("id") %&gt;'
                                                  CommandName="more info" CssClass="btn" OnCommand="StatusButton_Command" Text="Require more info" /&gt;
                                          &lt;/td&gt;
                                      &lt;/tr&gt;
                                  &lt;/table&gt;
                              &lt;/ItemTemplate&gt;
  
  </code></pre>
  
  <p>and here's the C# code behind page:</p>
  
  <pre><code>
  protected void FormView1_DataBound(object sender, EventArgs e)
  {
      // databinding for things that weren't set up with Bind()
      //  does not have any content for the purchase_reasonTextBox or product_descriptionTextBox
  }
  protected void FormView1_ItemCreated(object sender, EventArgs e)
      {
          FormViewRow row = FormView1.Row;
          if (FormView1.CurrentMode == FormViewMode.Edit || FormView1.CurrentMode == FormViewMode.Insert)
          {
              //initialize
              if (FormView1.CurrentMode == FormViewMode.Insert)
              {
                  // nothing relevant
              }
              else if (FormView1.CurrentMode == FormViewMode.Edit)
              {
                  //nothing relevant
              }
  
              FredCK.FCKeditorV2.FCKeditor purchase_reasonTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("purchase_reasonTextBox");
              if (purchase_reasonTextBox != null)
              {
                  purchase_reasonTextBox.CustomConfigurationsPath = Request.ApplicationPath + "/include/fckconfig.js";
                  purchase_reasonTextBox.EditorAreaCSS = Request.ApplicationPath + "/App_Themes/FrontTheme/Style.css";
                  purchase_reasonTextBox.StylesXmlPath = Request.ApplicationPath + "/include/fckstyles.xml";
              }
  
              FredCK.FCKeditorV2.FCKeditor product_descriptionTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("product_descriptionTextBox");
              if (product_descriptionTextBox != null)
              {
                  product_descriptionTextBox.CustomConfigurationsPath = Request.ApplicationPath + "/include/fckconfig.js";
                  product_descriptionTextBox.EditorAreaCSS = Request.ApplicationPath + "/App_Themes/FrontTheme/Style.css";
                  product_descriptionTextBox.StylesXmlPath = Request.ApplicationPath + "/include/fckstyles.xml";
              }
          }
      }
      protected void FormView1_ItemUpdating(object sender, FormViewUpdateEventArgs e)
      {
          FormViewRow row = FormView1.Row;
          if (FormView1.CurrentMode == FormViewMode.Edit)
          {
          //nothing relevant
          }
      }
  
  
  </code></pre>
  
  <p>I'm running out of ideas for how to work around this issue.  I <strong>Have</strong> to clean the content, and I'm not allowed to edit the database directly.  </p>
  
  <p>here's the last set of changes I tried:</p>
  
  <pre><code>protected void FormView1_DataBound(object sender, EventArgs e)
  {
      FredCK.FCKeditorV2.FCKeditor purchase_reasonTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("purchase_reasonTextBox");
      if (purchase_reasonTextBox != null)
      {
          purchase_reasonTextBox.CustomConfigurationsPath = Request.ApplicationPath + "/include/fckconfig.js";
          purchase_reasonTextBox.EditorAreaCSS = Request.ApplicationPath + "/App_Themes/FrontTheme/Style.css";
          purchase_reasonTextBox.StylesXmlPath = Request.ApplicationPath + "/include/fckstyles.xml";
      }
      purchase_reasonTextBox.Value = GetCleanedText(rowView["purchase_reason"].ToString());
      FredCK.FCKeditorV2.FCKeditor product_descriptionTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("product_descriptionTextBox");
      if (product_descriptionTextBox != null)
      {
          product_descriptionTextBox.CustomConfigurationsPath = Request.ApplicationPath + "/include/fckconfig.js";
          product_descriptionTextBox.EditorAreaCSS = Request.ApplicationPath + "/App_Themes/FrontTheme/Style.css";
          product_descriptionTextBox.StylesXmlPath = Request.ApplicationPath + "/include/fckstyles.xml";
      }
      product_descriptionTextBox.Value = GetCleanedText(rowView["product_description"].ToString());
  }
  protected void FormView1_ItemUpdating(object sender, FormViewUpdateEventArgs e)
  {
          FormViewRow row = FormView1.Row;
          if (FormView1.CurrentMode == FormViewMode.Edit)
          {
              FredCK.FCKeditorV2.FCKeditor purchase_reasonTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("purchase_reasonTextBox");
              e.NewValues["purchase_reason"] = purchase_reasonTextBox.Value; //GetCleanedText(purchase_reasonTextBox.Value);
              FredCK.FCKeditorV2.FCKeditor product_descriptionTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("product_descriptionTextBox");
              e.NewValues["product_description"] = product_descriptionTextBox.Value; //GetCleanedText(product_descriptionTextBox.Value);
          }
  }
  
  protected void FormView1_ItemInserting(object sender, FormViewInsertEventArgs e)
  {
          Response.Write("  --  Item Inserting --  ");
          FormViewRow row = FormView1.Row;
          if (FormView1.CurrentMode == FormViewMode.Insert)
          {
              FredCK.FCKeditorV2.FCKeditor purchase_reasonTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("purchase_reasonTextBox");
              e.Values["purchase_reason"] = GetCleanedText(purchase_reasonTextBox.Value);
              FredCK.FCKeditorV2.FCKeditor product_descriptionTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("product_descriptionTextBox");
              e.Values["product_description"] = GetCleanedText(product_descriptionTextBox.Value);
      }
  }
  </code></pre>
  
  <p>I would appreciate any advice on how to get the text content inside of the text boxes returned to plain text</p>
  
  <pre><code>&lt;FCKeditorV2:FCKeditor ID="purchase_reasonTextBox" runat="server" BasePath="~/fckeditor/" Height="150px" ToolbarSet="Request" Value='&lt;%# Bind("purchase_reason") %&gt;'&gt;
  &lt;/FCKeditorV2:FCKeditor&gt;
  &lt;FCKeditorV2:FCKeditor ID="product_descriptionTextBox" runat="server" BasePath="~/fckeditor/" Height="150px" ToolbarSet="Request" Value='&lt;%# Bind("product_description") %&gt;'&gt;
  &lt;/FCKeditorV2:FCKeditor&gt;
  </code></pre>