Extending strip_tags() for allowing certain html tags

From: Date: Mon, 29 Dec 2003 16:25:27 +0000
Subject: Extending strip_tags() for allowing certain html tags
Groups: php.general 
Request: Send a blank email to php-general+get-173435@lists.php.net to get a copy of this message
I found some code at http://marc.theaimsgroup.com/?l=php-general&m=106942414231212&w=2 that was meant to extend strip_tags() where it wouldn't be blindly prone to XSS attacks via tag attributes. Unfortunately, that code works too good. If one were to pass a legal <img> tags like <img src="http://us2.php.net/images/php_snow.gif" /> It gets reduced to <img> Does anyone have any suggestions on how to modify that code (or any code), where one is bypassing certain tags, while keeping those certain tags "safe" (as safe as one can be) Thanks for you suggestions.

« previous php.general (#173435) next »