striping html tags

[aarrgghh]

Hello all,

I have set up a forum. I need an easy way to strip tags that is reliable and safe.

Thanks in advance!

 

[aarrgghh]

javascript tags too!

 

[martinb7]

the str_replace() function would do it

Martin

Computing help and info:

http://www.webrevolt.biz

 

[Westbury]

Or run it through htmlspecialchars(). That way if anyone types any code it'll be converted so that any < or > becomes &lt; and &gt;

 

[martinb7]

yea you can use that too. use which you find easier

Martin

Computing help and info:

http://www.webrevolt.biz

 

[aarrgghh]

using htmlspecialcharacters what would the output be for:

<img src=&quot;javascript:alert('hello')&quot;>

and

</ta</table>ble>

?

Thanks again!

 

[martinb7]

im not sure about the htmlspecialchars() u wud prob find it easier 2 do with str_replace 2 check 4 all html

good luck

Martin

Computing help and info:

http://www.webrevolt.biz

 

[DRJ478]

There is a standard PHP function to remove all tags:

http://ca2.php.net/manual/en/function.strip-tags.php

 

[aarrgghh]

Yeah I was looking at that one, but not sure that it catches

</ta</table>ble>

unless I wrote a loop function. Don't tell anyone, but I am just trying to be lazy.

 

[Westbury]

htmlspecialchars would change

</ta</table>ble>

into
&lt;/ta&lt/table&gt;ble&gt;

I though this might be best for a forum so that anyone who wants to post any special html characters (&<>&quot;') for legitimate reason, can do so.
The function that DRJ478 is also a good idea. I didn't even know that existed. You learn something new everyday

 

[DRJ478]

You want to strip the tags to keep users from posting HTML or malicious code.

</ta</table>ble>

will be stripped by strip_tags into

ble>

.
This means the tag is disabled even though there is a remnant of the nested tags.

Converting to htmspecialchars will display the tags in a kind of source code view and also disable them. If you state on your site that HTML will be disabled people who try to post HTML etc. will just have to reckon ugly looking posts.

 

[martinb7]

use the str_replace function!

$string = $_POST['formthing'];

$string2 = str_replace(&quot;</script> </script&quot;, &quot;&quot;, $string);

echo($string);

gd luck


Martin

Computing help and info:

http://www.webrevolt.biz