craygo Posted January 24, 2008 Share Posted January 24, 2008 I have a site which users can write reviews for products. I want to make sure they don't use malicious code in the reviews like <script> and things like that. How would I go about coding this?? Just create an array of words to look for and deny the insert?? Any help and code is appreciated. Ray Link to comment https://forums.phpfreaks.com/topic/87625-solved-check-for-code/ Share on other sites More sharing options...
revraz Posted January 24, 2008 Share Posted January 24, 2008 You want to block all HTML or just certain tags? Link to comment https://forums.phpfreaks.com/topic/87625-solved-check-for-code/#findComment-448167 Share on other sites More sharing options...
craygo Posted January 24, 2008 Author Share Posted January 24, 2008 just certain tags, I would still like to let them use <br> for line break and <b>, <u>. things like that. Link to comment https://forums.phpfreaks.com/topic/87625-solved-check-for-code/#findComment-448169 Share on other sites More sharing options...
PHP Monkeh Posted January 24, 2008 Share Posted January 24, 2008 I'd stop them from using any html code in your input forms, and just allow them to use bbcode and parse it that way (i.e. replacing all with <b> when you're outputting what they've written). I just think it would be a lot safer that way. Link to comment https://forums.phpfreaks.com/topic/87625-solved-check-for-code/#findComment-448188 Share on other sites More sharing options...
craygo Posted January 24, 2008 Author Share Posted January 24, 2008 what would be the easiest way to check for code. I would just like to check for any code and if found deny the insert. Link to comment https://forums.phpfreaks.com/topic/87625-solved-check-for-code/#findComment-448194 Share on other sites More sharing options...
PHP Monkeh Posted January 24, 2008 Share Posted January 24, 2008 Bah, my previous post didn't work the way I intended and I didn't check it (i.e. placing all [b] with <b> when you're outputting what they've written). I'm not sure how you could deny all code except < b > etc that's the problem. Hopefully someone else can (I'm hopeless with regex) Link to comment https://forums.phpfreaks.com/topic/87625-solved-check-for-code/#findComment-448199 Share on other sites More sharing options...
craygo Posted January 24, 2008 Author Share Posted January 24, 2008 lol me too, never understood regex Link to comment https://forums.phpfreaks.com/topic/87625-solved-check-for-code/#findComment-448200 Share on other sites More sharing options...
resago Posted January 24, 2008 Share Posted January 24, 2008 make an array of bad tags use preg_replace if $count>0 then it found a baddy. Link to comment https://forums.phpfreaks.com/topic/87625-solved-check-for-code/#findComment-448346 Share on other sites More sharing options...
KrisNz Posted January 24, 2008 Share Posted January 24, 2008 strip_tags lets you pass a string of allowable tags and then it will only strip ones you don't want. You could then compare the original post to the stripped one and if they were different you'd know the user had submitted dodgy content. Obviously that won't help with the seven words you cant say on tv.... Link to comment https://forums.phpfreaks.com/topic/87625-solved-check-for-code/#findComment-448374 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.