note 49234 deleted from function.preg-replace by colder
| From: | colder@php.net | Date: | Mon, 18 Jun 2007 19:52:03 +0000 |
| Subject: | note 49234 deleted from function.preg-replace by colder | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-127670@lists.php.net to get a copy of this message | ||
Note Submitter: Nick
----
Here is a more secure version of the link conversion code which hopefully make cross site scripting
attacks more difficult.
<?php
function convert_links($str) {
$replace = <<<EOPHP
'<a href="'.htmlentities('\\1').htmlentities('\\2').//remove
line break
'">'.htmlentities('\\1').htmlentities('\\2').'</a>'
EOPHP;
$str = preg_replace('#(http://)([^\s]*)#e', $replace, $str);
return $str;
}
?>