开发者

php striping with exceptions or reorganizing htmlspecialchar

开发者 https://www.devze.com 2023-02-26 07:09 出处:网络
I\'m trying to build a web site basicly for sharing sample codes and comments. My problem is avoiding any tags/scripts except a img and some very common ones like i b... I tried different solutions bu

I'm trying to build a web site basicly for sharing sample codes and comments. My problem is avoiding any tags/scripts except a img and some very common ones like i b... I tried different solutions but at one point all of them stacks: If user uses < not for tags, meaning less than...

First started my code with spliting the tags, split_tag the other places and htmlspecialchars to the code part then remerge them. But still if user uses < anywhere in text part it erases the post until it sees a >. (Also tried to avoid strip_tags to erase, by putting a whitespace after < but couldnt find a way to recognize if it is a tag or less than)

Then i tried it backward. Used htmlspecialchars for all post and change the specific ones back to tag appearance. This time i got trouble with all replace functions because some of them didnt worked correctly or overlap with eachothe开发者_如何学编程r. I feel like there is a simple solution but i couldnt looked at the right angle. Any suggestions ?

$yazi = htmlspecialchars($_POST["yazi"]);

$yazi = str_replace('&lt;a href=&quot;', '<a href"', $yazi);

$yazi = str_replace('&lt;&#47a&gt;', '</a>', $yazi);

$yazi = str_replace('&lt;code&gt;','<code>', $yazi);

$yazi = str_replace('&lt;&#47codea&gt;', '</code>', $yazi);

$yazi = str_replace('&lt;br&gt;', '<br>', $yazi);

$yazi = str_replace('&lt;i&gt;', '<i>', $yazi);

$yazi = str_replace('&lt;&#47i&gt;', '</i>', $yazi);

$yazi = str_replace('&lt;b&gt;','<b>',$yazi);

$yazi = str_replace('&lt;&#47b&gt;','</b>',$yazi);

$yazi = str_replace('&lt;p&gt;','<p>',$yazi);

$yazi = str_replace('&lt;&#47p&gt;','</p>',$yazi);

$yazi = str_replace('&lt;img src=&quot;', '<img src="', $yazi);

$yazi = str_replace('&quot;/&gt;', '"/>', $yazi);

$yazi = str_replace('&quot; /&gt;', '" />', $yazi);

$yazi = str_replace('&quot;&gt;', '">', $yazi);

$yazi = str_replace('&quot; &gt;', '" >', $yazi);


Sounds like you want an HTML sanitizer.

http://htmlpurifier.org/ looks pretty good.

0

精彩评论

暂无评论...
验证码 换一张
取 消

关注公众号