note 80427 added to function.strip-tags

An improved version of tREXX and Tony Freeman's code, this keeps the code clean while removing unwanted attributes, including the javascript: protocol. Unlike the built-in strip_tags() function, this takes an array for allowed tags, rather than a string. For example: array('<a>', '<object>'); I don't understand why the built-in function uses a string.. oh well =) <?php function strip_tags_attributes($sSource, $aAllowedTags = array(), $aDisabledAttributes = array('onclick', 'ondblclick', 'onkeydown', 'onkeypress', 'onkeyup', 'onload', 'onmousedown', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onunload')) { if (empty($aDisabledEvents)) return strip_tags($sSource, implode('', $aAllowedTags)); return preg_replace('/<(.*?)>/ie', "'<' . preg_replace(array('/javascript:[^\"\']*/i', '/(" . implode('|', $aDisabledAttributes) . ")=[\"\'][^\"\']*[\"\']/i', '/\s+/'), array('', '', ' '), stripslashes('\\1')) . '>'", strip_tags($sSource, implode('', $aAllowedTags))); } ?> ---- Server IP: 208.69.120.35 Probable Submitter: 64.128.188.63 ---- Manual Page -- http://www.php.net/manual/en/function.strip-tags.php Edit -- https://master.php.net/note/edit/80427 Del: integrated -- https://master.php.net/note/delete/80427/integrated Del: useless -- https://master.php.net/note/delete/80427/useless Del: bad code -- https://master.php.net/note/delete/80427/bad+code Del: spam -- https://master.php.net/note/delete/80427/spam Del: non-english -- https://master.php.net/note/delete/80427/non-english Del: in docs -- https://master.php.net/note/delete/80427/in+docs Del: other reasons-- https://master.php.net/note/delete/80427 Reject -- https://master.php.net/note/reject/80427 Search -- https://master.php.net/manage/user-notes.php