Zepo. Posted December 21, 2007 Share Posted December 21, 2007 I have an about me section for each member, where i would like to allow html, like videos,games and font stuff. The thing is how would i allow that, and disallow javascript, and other potentially harmfull code? Quote Link to comment Share on other sites More sharing options...
pocobueno1388 Posted December 21, 2007 Share Posted December 21, 2007 Here is a nice class you can download that will allow you to do this http://htmlpurifier.org/ Quote Link to comment Share on other sites More sharing options...
Zepo. Posted December 21, 2007 Author Share Posted December 21, 2007 Wow, thats a large script. I'm looking for something a lil less fancy and large. Quote Link to comment Share on other sites More sharing options...
trq Posted December 21, 2007 Share Posted December 21, 2007 strip_tags. Quote Link to comment Share on other sites More sharing options...
Jessica Posted December 21, 2007 Share Posted December 21, 2007 He wants to allow safe HTML. Â Dude just use the one he posted. There are others but it's always going to be larger than you think it should be. Why does it matter how big it is anyway? Quote Link to comment Share on other sites More sharing options...
trq Posted December 21, 2007 Share Posted December 21, 2007 He wants to allow safe HTML. Â And strip_tags has a second argument that allows just that! Quote Link to comment Share on other sites More sharing options...
Jessica Posted December 21, 2007 Share Posted December 21, 2007 Well, it doesn't protect against malicious JS:  Warning  This function does not modify any attributes on the tags that you allow using allowable_tags , including the style and onmouseover attributes that a mischievous user may abuse when posting text that will be shown to other users.   That is why I said it won't work. Yes, you can allow the tags you want, but a user could still enter XSS attacks. Quote Link to comment Share on other sites More sharing options...
trq Posted December 21, 2007 Share Posted December 21, 2007 That is why I said it won't work  No its not, but yes, it will not protect against js. Quote Link to comment Share on other sites More sharing options...
Jessica Posted December 21, 2007 Share Posted December 21, 2007 It is too. :-P I said it won't work because I have done this before, and I knew it didn't work. I forgot why, and had to look it up. But it's not what he wants. Quote Link to comment Share on other sites More sharing options...
Zepo. Posted December 21, 2007 Author Share Posted December 21, 2007 Well i dont want i guess ill just strip all html, but thats no fun o_o. Quote Link to comment Share on other sites More sharing options...
Jessica Posted December 21, 2007 Share Posted December 21, 2007 Why don't you just use one of the many html cleaning libraries already out there? I use this one: http://pear.php.net/package/HTML_Safe Quote Link to comment Share on other sites More sharing options...
Zepo. Posted December 21, 2007 Author Share Posted December 21, 2007 Kay with a little rewriting, the last one worked. Thanks. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.