Bug #10362: strip_tags() strips round brackets inside allowed html tags
| From: | jo at feuersee dot de | Date: | Tue, 17 Apr 2001 16:02:44 +0000 |
| Subject: | Bug #10362: strip_tags() strips round brackets inside allowed html tags | ||
| Groups: | php.dev | ||
| Request: | Send a blank email to php-dev+get-51804@lists.php.net to get a copy of this message | ||
From: jo@feuersee.de
Operating system: Linux 2.4.3
PHP version: 4.0.4pl1
PHP Bug Type: Unknown/Other Function
Bug description: strip_tags() strips round brackets inside allowed html tags
When using strip_tags() with the optional conversion
param, it still strips round brackets "()" from the input
string.
Example:
<?php
$allowed = "<a>";
$tag = "<a href=\"$PHP_SELF\" ";
$tag .= "onClick=\"alert('Hello')\">click</a>";
printf("%s", strip_tags($tag, $allowed));
?>
results in
<a href="whatever.php" onCLick="alert'Hello'">click</a>
missing brackets---------------------^-----^
and leaves the <a> Tag unuseable.
--
Edit Bug report at: http://bugs.php.net/?id=10362&edit=1