Re: AW: [PHP] Re: Second opinion needed - javascript blocker
| From: | Justin French | Date: | Tue, 23 Apr 2002 05:24:42 +0000 |
| Subject: | Re: AW: [PHP] Re: Second opinion needed - javascript blocker | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-94114@lists.php.net to get a copy of this message | ||
on 23/04/02 1:59 PM, Martin Towell (martin.towell@world.net) wrote:
> would become
>
> =foo
> ="foo"
> = "foo"
> ='foo'
> ='foo'
>
> which the browser would just ignore
In theory, yes. I don't think I'd trust it here -- this is potentially
malicious content added by unknown people. I'd be taking the approach keep
what you trust, throw out the rest, which is a more complex set of regexps
though.
hence <B anything> should be trimmed back to <B>.... this is easier on a
smaller subset of HTML, rather than "all HTML".
I personally would not give unknown contributors any more than you have to.
Justin
--------------------
Creative Director
http://Indent.com.au
--------------------