< Neo22s />

7 Comments

1. Steve says:

   November 3, 2009 at 6:48 PM

   You’ll probably be better off using the strip_tags function to remove any HTML tags. There’s also htmlspecialchars and htmlentities to convert special characters to entities. Something like the below code will remove tags from input:
   $_POST = array_map(’strip_tags’, $_POST);
   $_GET = array_map(’strip_tags’, $_GET);

   Note that strip_tags also accepts a white list of allowed tags. Alternatively, the below will cause special characters to be displayed as text and not rendered by the browser:
   $_POST = array_map(‘htmlentities’, $_POST);
   $_GET = array_map(‘htmlentities’, $_GET);

   Also, the ereg* functions have been deprecated in favor of preg* functions for regular expressions.

   http://www.php.net/manual/function.strip-tags.php
   http://www.php.net/manual/function.htmlspecialchars.php
   http://www.php.net/manual/function.htmlentities.php
   http://www.php.net/manual/function.array-map.php

   I hope you find this useful. :)
2. Chema says:

   November 3, 2009 at 9:59 PM

   Hi Steve,

   Thanks for the info it is really usefull, your proposal is really good, but for example in my case I want it to allow css style. With the code that I propose it is possible since you can just comment the line and then it would be allowed.

   Another time thanks for the info ;)
3. Steve says:

   November 3, 2009 at 10:52 PM

   You can also do something like this to provide a white list of allowed tags. In this example, it allows p, em, and strong tags. Any CSS can be applied to these tags as well.

   $clean = array_map(‘clean_input’, $_POST);
   function clean_input($value)
   {
   return strip_tags($value, ‘‘);
   }

   Keep in mind that allowing some tags will also allow JavaScript injection, so it might be best to use BBCode type tags instead of allowing any HTML.
4. Steve says:

   November 3, 2009 at 10:56 PM

   Sorry, the code above got messed up. Here it is again:

   $clean = array_map('clean_input', $_POST);
   function clean_input($value)
   {
      return strip_tags($value, '');
   }
5. Chema says:

   November 4, 2009 at 9:18 AM

   yes I think you are right and bbcode is better .

   Thanks for your sharing and if you have any example off bbcode is welcome.
6. Steve says:

   November 4, 2009 at 8:44 PM

   Here’s a tutorial I wrote about creating a BBCode parser function:
   http://www.ultramegatech.com/blog/2009/04/creating-a-bbcode-parser/

   You also might be interested in this PECL extension, which seems to allow more advanced parsing:
   http://www.php.net/manual/book.bbcode.php
7. Chema says:

   November 4, 2009 at 10:00 PM

   Rally useful Steve! I just bookmark it! nice ;)