PHP: Custom Markups and preg_replace

[LordDan]

Hello PHPfreaks,

 

my first post so i'll keep it short, recently i have started playing with preg_replace to create BBCode for one of my websites forums and have since been experimenting with it.

 

I've attempted to do something similar to facebook and their FBML (Facebook Markup Language) and wanted to see if i could make a simple markup which could allow users to create custom mini-apps.

 

So far i have this as my markup.

<vpc:start>
  <vpc:layer name="MyLayer">
    <vpc:var type="text" name="myName" value="Dan">
    <vpc:var type="numeric" name="myAge" value="20">
    <vpc:text atid="myID" value="Hello World">
    <vpc:text atid="myID2" value="Hello (v:myName:v), how are you?">
  </vpc:layer>
<vpc:end>

 

Which converts to javascript like so:

 

<script type="text/javascript">  
  function MyLayer(){ 
    var myName = "Dan"; 
    var myAge = 20; 
    document.getElementById('myID').innerHTML = "Hello World";
    document.getElementById('myID2').innerHTML = "Hello "+myName+", how are you?";
} 
</script>

 

This works fine, but the obvious flaw is that after typing <vpc:start> users can just type javascript however they want. I am confused as to how facebook and a few other sites manage to create a custom markup which allows creation of custom mini-apps securely.

 

I'm not even sure if i am going about this the correct way. But so far i am using this PHP function to convert.

 

function vParse($Input){

        # (Find)      Array of vpc Elements to Parse.
        $VP[0] = '/<vpc\:start>(.*?)<vpc\:end>/is';
        $VP[1] = '/<vpc\:layer name=\\\"(.*?)\\\">(.*?)<\/vpc\:layer>/is';
        $VP[2] = '/<vpc\:var type=\\\"text\\\" name=\\\"(.*?)\\\" value=\\\"(.*?)\\\">/is';
        $VP[3] = '/<vpc\:var type=\\\"numeric\\\" name=\\\"(.*?)\\\" value=\\\"(.*?)\\\">/is';
        $VP[4] = '/<vpc\:text atid=\\\"(.*?)\\\" value=\\\"(.*?)\\\">/is';
        $VP[5] = '/\(v\.*?)\:v\)/is';


        # (Replace)   Array of Javascript Elements to Parse.
        $JS[0] = "<script type=\"text/javascript\">\\1</script>";
        $JS[1] = "function \\1(){\\2}";
        $JS[2] = "var \\1 = \"\\2\";";
        $JS[3] = "var \\1 = \\2;";
        $JS[4] = "document.getElementById('\\1').innerHTML = \"\\2\";";
        $JS[5] = "\"+\\1+\"";

        # Replace the BB.
        return $Output = preg_replace($VP, $JS, $Input);

    }

 

My website has great potential for user generated apps and i would like to take advantage of this. Has anybody here had experience with custom markups/ API's and user created apps? Any advice? I would really like to start studies into this area.

 

Regards,

Dan.

www.v-petsite.com