Live BB-Parsing

[redarrow]

Very simple but looks grate good layout well done.

[cmgmyr]

I like it too, good job and keep up the good work!

[tomfmason]

I like the idea and I have written something like this for a client in the past. Overall I like your script. However, I see that you did not really take any measures to prevent xss. You can test this by typing the following bbcode:

 

[nobbc][url =javascript:alert('Simple xss attack');]Simple xss attack[/url][nobbc].

 

There should be a simple fix for this and as a general rule, if possible, I would avoid using eval(). Also here are some nice articles on xss and it's prevention.

 

http://www-128.ibm.com/developerworks/web/library/wa-secxss/?ca=dnt-55

http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/cross-site-malicious-content.html

http://weblogs.java.net/blog/gmurray71/archive/2006/09/preventing_cros.html

 

edit

 

I had to add a space between url and the = in the example bbcode. And you will need to remove the nobbc tags

 

 

[Lumio]

Thank you for posting that. I'll fix it.