Category description getting cleared

Vanilla 1.5.7c install

Trying to add a category description that would be a simple img tag. ie ```
<img src="images/my_category.jpg">

After saving, the category description is blank and nothing is stored in the database.
Adding some text together with the img tag seems to work - adding ```
blah blah <img src="images/my_category.jpg">
``` works and gets added to database.

I've pinpointed this to admin/categories.php on line 147:

$sql_data_array = [
'categories_name' => zen_db_prepare_input($categories_name_array[$language_id]),
'categories_description' => empty(trim(strip_tags($categories_description_array[$language_id]))) ? '' : zen_db_prepare_input($categories_description_array[$language_id])
];

Is there something I'm not seeing here, some specific reason why we're not allowing just an image as category description? Wouldn't it be more user-friendly to throw a warning instead of just strip it all down without notice? I understand such a "description" isn't the optimal choice, but sometimes it's all you have and all you need...

balihr:

I understand such a "description" isn't the optimal choice, but sometimes it's all you have and all you need...It may be that the image tells the whole story BUT, a couple of things to remember.

With no alt tag, the browser/SE has no idea what the image is about. So, a search engine will have no way of evaluating or displaying your product's description.

Even with an alt tag, it might need to be a really big one to tell the SE what you are trying to say.

Extra credit -- Even with today's faster speeds, some folks still have images turned off until they think they need them. That gets more relevant with a mobile environment.

Perhaps enough text to help the SEs and a popup window to satisfy the need to "see" the info.

Also, why isn't the category image available for use to stow that image? Or perhaps asked another way, what is the reason that the category description is using an image (only) to "explain" what the category is about?

In part I was thinking that perhaps there was some desire to obfuscate the content, but that doesn't seem to align with a SE related aspect...

As far as putting some content, wouldn't a ```
 

balihr:

I've pinpointed this to admin/categories.php on line 147:

$sql_data_array = [
'categories_name' => zen_db_prepare_input($categories_name_array[$language_id]),
'categories_description' => empty(trim(strip_tags($categories_description_array[$language_id]))) ? '' : zen_db_prepare_input($categories_description_array[$language_id])
];

> 
> Is there something I'm not seeing here, some specific reason why we're not allowing just an image as category description? Wouldn't it be more user-friendly to throw a warning instead of just strip it all down without notice? I understand such a "description" isn't the optimal choice, but sometimes it's all you have and all you need...

i would like to answer this question.....

i see no reason why we do not allow it.  i would encourage a PR to correct said behavior.

i love @torvista; this is one of his PRs.  see:

<https://github.com/zencart/zencart/commit/29e8c4bfaad2c3b51f7d363db388e9320af22eed>

perhaps he can explain the rationale for it...  i agree with @balihr; this behavior seems rude....  have the code remove input with no warning; it makes little sense to me....

@dbltoe & @mc12345678 - guys, I think you missed the point. I wasn't trying to discuss the SEO aspect nor the reason why someone would want to do that. But okay, let's talk about it.
This was just a simple example so I stripped alt and title tags because it makes no difference. You can have alt, title, data-* or whatever you want - if it's inside a standalone img tag, it just gets stripped without notice. It's like you're trying to upload something malicious and you get blocked. My first thought was sanitizer and I had spent half an hour debugging it without success so I had to rule it out, only to find this piece of code.

Now imagine being a store owner - you have no clue this will happen and you do this for 20 categories. Again, let's NOT discuss whether this is a good idea or if it should/shouldn't be done. So, you do this for 20 categories, and then you go check what you've done and nothing's there. OK, something went wrong, you go again, add 5 descriptions/images this time, go check your work and again, nothing's there. All of a sudden, an innocent passerby gets struck by a laptop that went flying out the window...

mc12345678:

As far as putting some content, wouldn't a ```

It probably would, but do you think the store owner from the story above knows about it? Even if you put this in the docs, will he/she find it? Will it make any sense?

**What I'm saying** - we either need a warning in messagestack to let the store owner know that the code was stripped down, or we shouldn't strip it down. Or maybe something else, dunno. **Just not a silent strip down.**

Now for a real life example: let's say a category with balloons where the main category image is a balloon, but when you access the category, there's a banner with some examples and information about the balloons in that category presented as a single image. Yeah, not the best approach, but this is not the topic here.

So, back to the original question - is there an actual reason why this would be stripped? Like security issues or something really significant?

As a solution, may I suggest this:

$sql_data_array = [
'categories_name' => zen_db_prepare_input($categories_name_array[$language_id]),
'categories_description' => empty(trim(strip_tags($categories_description_array[$language_id]))) ? '' : zen_db_prepare_input($categories_description_array[$language_id])
];

$sql_data_array = [
'categories_name' => zen_db_prepare_input($categories_name_array[$language_id]),
'categories_description' => empty(trim(strip_tags($categories_description_array[$language_id], '<img>'))) ? '' : zen_db_prepare_input($categories_description_array[$language_id])
];

This way we still strip empty tags, but img tags are allowed.

The history on this is that torvista posted to git the following:

While clearing a bug (unrelated) , I find this;

// clean $categories_description when blank or just <p /> left behind
$sql_data_array = [
'categories_name' => zen_db_prepare_input($categories_name_array[$language_id]),
'categories_description' => ($categories_description_array[$language_id] === '<p />' ? '' : zen_db_prepare_input($categories_description_array[$language_id]))
];

This seems too deliberate to be a mistake, anyone care to explain?

Dr. Byte responded with:

It was added in 1.2.0 to catch cases where javascript-driven rich-text editors would leave behind empty html blocks, usually empty paragraphs.

I think one of the editors at the time was leaving a self-closing paragraph tag, hence the <p />.

But a better way would be to just test if empty(trim(strip_tags($foo)))

So torvista submitted a pull request to change it to what we have now. Probably not tested to see what would happen with just an image tag in there.

The image tag probably should not be the only one ignored.
The following is a complete list of the void elements in HTML:

area, base, br, col, command, embed, hr, img, input, keygen, link, meta, param, source, track, wbr

Some of those can be ignored in this context as they should never be inside the content of the page anyway.
I have not yet tested any of the other listed elements to see what happens

Thanks, @carlwhat & @barco57 - glad I'm not the only one who sees this as an issue.

PR submitted: https://github.com/zencart/zencart/pull/4462

Just added <a> and <hr> tags in case the <img> tag gets wrapped with <a> and/or followed by <hr>. Baaaaaaad idea to do (in case any storeowner is reading this: avoid this behavior), but hey, people get various kinds of bad ideas anyway...

Sorry if I muddled the puddle. I was not trying to say it was not an issue. Simply that other issues could arise with its use that might be worse for the site than not having an image.