Zepo. Posted December 21, 2007 Share Posted December 21, 2007 I have an about me section for each member, where i would like to allow html, like videos,games and font stuff. The thing is how would i allow that, and disallow javascript, and other potentially harmfull code? Link to comment https://forums.phpfreaks.com/topic/82608-stripping-unsafe-html/ Share on other sites More sharing options...
pocobueno1388 Posted December 21, 2007 Share Posted December 21, 2007 Here is a nice class you can download that will allow you to do this http://htmlpurifier.org/ Link to comment https://forums.phpfreaks.com/topic/82608-stripping-unsafe-html/#findComment-420058 Share on other sites More sharing options...
Zepo. Posted December 21, 2007 Author Share Posted December 21, 2007 Wow, thats a large script. I'm looking for something a lil less fancy and large. Link to comment https://forums.phpfreaks.com/topic/82608-stripping-unsafe-html/#findComment-420065 Share on other sites More sharing options...
trq Posted December 21, 2007 Share Posted December 21, 2007 strip_tags. Link to comment https://forums.phpfreaks.com/topic/82608-stripping-unsafe-html/#findComment-420067 Share on other sites More sharing options...
Jessica Posted December 21, 2007 Share Posted December 21, 2007 He wants to allow safe HTML. Â Dude just use the one he posted. There are others but it's always going to be larger than you think it should be. Why does it matter how big it is anyway? Link to comment https://forums.phpfreaks.com/topic/82608-stripping-unsafe-html/#findComment-420072 Share on other sites More sharing options...
trq Posted December 21, 2007 Share Posted December 21, 2007 He wants to allow safe HTML. Â And strip_tags has a second argument that allows just that! Link to comment https://forums.phpfreaks.com/topic/82608-stripping-unsafe-html/#findComment-420074 Share on other sites More sharing options...
Jessica Posted December 21, 2007 Share Posted December 21, 2007 Well, it doesn't protect against malicious JS:  Warning  This function does not modify any attributes on the tags that you allow using allowable_tags , including the style and onmouseover attributes that a mischievous user may abuse when posting text that will be shown to other users.   That is why I said it won't work. Yes, you can allow the tags you want, but a user could still enter XSS attacks. Link to comment https://forums.phpfreaks.com/topic/82608-stripping-unsafe-html/#findComment-420079 Share on other sites More sharing options...
trq Posted December 21, 2007 Share Posted December 21, 2007 That is why I said it won't work  No its not, but yes, it will not protect against js. Link to comment https://forums.phpfreaks.com/topic/82608-stripping-unsafe-html/#findComment-420083 Share on other sites More sharing options...
Jessica Posted December 21, 2007 Share Posted December 21, 2007 It is too. :-P I said it won't work because I have done this before, and I knew it didn't work. I forgot why, and had to look it up. But it's not what he wants. Link to comment https://forums.phpfreaks.com/topic/82608-stripping-unsafe-html/#findComment-420098 Share on other sites More sharing options...
Zepo. Posted December 21, 2007 Author Share Posted December 21, 2007 Well i dont want i guess ill just strip all html, but thats no fun o_o. Link to comment https://forums.phpfreaks.com/topic/82608-stripping-unsafe-html/#findComment-420110 Share on other sites More sharing options...
Jessica Posted December 21, 2007 Share Posted December 21, 2007 Why don't you just use one of the many html cleaning libraries already out there? I use this one: http://pear.php.net/package/HTML_Safe Link to comment https://forums.phpfreaks.com/topic/82608-stripping-unsafe-html/#findComment-420145 Share on other sites More sharing options...
Zepo. Posted December 21, 2007 Author Share Posted December 21, 2007 Kay with a little rewriting, the last one worked. Thanks. Link to comment https://forums.phpfreaks.com/topic/82608-stripping-unsafe-html/#findComment-420195 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.