RE: [PHP] RE: html in my form? bad things! help help help!
| From: | Ray Dow | Date: | Mon, 16 Jul 2001 06:28:50 +0000 |
| Subject: | RE: [PHP] RE: html in my form? bad things! help help help! | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-58018@lists.php.net to get a copy of this message | ||
Once you open up ANY HTML tag to the public you open a huge can of worms and
trouble, like the following for example
<a href="http://php.net"
onmousemove="javascript:alert('Blar Blar
Blar');">Click me!</a>
My javascript is not great (I could not think of anything more damaging) but
its pretty clear what the possibilities are.
Strip all tags and use a custom system is my advice
> -----Original Message-----
> From: zerosumzero@yahoo.com [mailto:zerosumzero@yahoo.com]
> Sent: Monday, 16 July 1979 3:59 PM
> To: Ray Dow; php-general@lists.php.net
> Subject: Re: [PHP] RE: html in my form? bad things! help help help!
>
>
> on 7/16/01 2:03 AM, Ray Dow at ray@massive.com.au wrote:
>
> > Everything removed by strip_tags(), including <a
> href="somelink>click
> > me</a> (you original example)
> >
> > See the problem?
>
> Everything isn't removed if you set it up like this:
>
>
> strip_tags($string,"<a>,<i>,<b>")
>
>
> that part is working fine, it's tags with missing quotes that
> have me worried, like this:
>
> <a href="http://www.someplace.com>My site!</a>
>
>
>
> --
> susan@futurebird.com
> http://futurebird.diaryland.com
>
>