Validating/Allowing YouTube Embed Code

hopefully this is a simple question. I have a simple custom forum on my site written in PHP. For security reasons I don't allow any HTML in the forum posts. I only allow certain BBCode tags. I would however like to allow embedded YouTube videos.

So my question is this: What's the best (most secure) way to validate the YouTube embed code? YouTube is currently using iframes to embed videos, but obviously I can't just allow the iframe tag. I also need to ensure the src of the iframe is a YouTube URL, and ensure there's no other malicious开发者_如何转开发 bits of code in the iframe code.

---

You should allow users to use something like this:

[youtube]http://www.youtube.com/watch?v=te-TiL9YVaE[/youtube]

And then turn it to embed code using PHP when displaying a message:

function bb_youtube($post) {
    return preg_replace(
                            "#\[youtube].*?v=([^&]+).*?\[/youtube\]#im",
                            '<object width="480" height="385"><param name="movie" value="http://www.youtube.com/v/$1?fs=1"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/$1?fs=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="480" height="385"></embed></object>',
                            $post
                           );
}

---

The safest way is to create a [youtube] tag. http://www.youtube.com/watch?v=PVHzXnS5Gms could become [youtube v='PVHzXnS5Gms'][/youtube] (or your syntax of choice).

To convert this into a YouTube embed code, take <object width="640" height="385"><param name="movie" value="http://www.youtube.com/v/VIDEO_ID?fs=1&amp;hl=en_US"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/VIDEO_ID?fs=1&amp;hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="385"></embed></object> and replace VIDEO_ID with the identifier.