Ask a Question related to PHP Notes, Design and Development.
-
gavin@vess.com #1
note 33993 added to function.strip-tags
Judging from the sheer number of "holes" found in the posted samples, clearly, creating "safe" html is a difficult task.
Consider an alternative (html to text) from Tom:
[url]http://www.perl.com/CPAN/authors/Tom_Christiansen/scripts/striphtml.gz[/url]
FYI, I noticed that no one has yet reported a flaw in inputCheck() from charlieNOSPAM's. It missed the case:
<img src="http://.com/transparent.gif" width=300 height=300 onmouseover="alert('hello')"
By dropping the trailing '>', the tag isn't uppercased, and then fails to match the rule (supposing that "IMG" was added to the list of tags to disable).
Most badhtml2safehtml() functions seem to miss the possibility of mixed case in the tags name, dangerous attributes, or malformed HTML that still executes something dangerous in a forgiving web browser.
----
Manual Page -- [url]http://www.php.net/manual/en/function.strip-tags.php[/url]
Edit Note -- [url]http://master.php.net/manage/user-notes.php?action=edit+33993[/url]
Delete Note -- [url]http://master.php.net/manage/user-notes.php?action=delete+33993&report=yes[/url]
Reject Note -- [url]http://master.php.net/manage/user-notes.php?action=reject+33993&report=yes[/url]
gavin@vess.com Guest
-
note 33871 rejected from function.strip-tags by torben
Note Submitter: sebsch1@gmx.de ---- hi ! i have a question ? :) If i Take "'<*?*?>'si" <b>...</b> ist disabled for example ... but if i... -
note 33826 modified in function.strip-tags by didou
To eminate the script tags found in html, don't use the preg_replace approach. The .* can include </script> when there are multiple script tags, and... -
note 33836 added to function.strip-tags
Correction: the line that reads $second = substr($html, $pos2 + 1); should read $second = substr($html, $pos2); ---- Manual Page --... -
note 33714 added to function.register-tick-function
please can anyone help me to discover if this function can be used to make a chat ---- Manual Page --... -
note 33580 added to function.strip-tags
For fixing the <scr<script></script>ipt> bug, wouldn't it be ok to call strip_tags iteratively until the string does not change anymore? ----...



Reply With Quote

