note 36574 deleted from function.strip-tags by ezyang

Note Submitter: tREXX [www.trexx.ch] ---- Here's a quite fast solution to remove unwanted tags AND also unwanted attributes within the allowed tags: <?php /** * Allow these tags */ $allowedTags = '<h1><b><i><a><ul><li><pre><hr><blockquote><img>'; /** * Disallow these attributes/prefix within a tag */ $stripAttrib = 'javascript:|onclick|ondblclick|onmousedown|onmouseup|onmouseover|'. 'onmousemove|onmouseout|onkeypress|onkeydown|onkeyup'; /** * @return string * @param string * @desc Strip forbidden tags and delegate tag-source check to removeEvilAttributes() */ function removeEvilTags($source) { global $allowedTags; $source = strip_tags($source, $allowedTags); return preg_replace('/<(.*?)>/ie', "'<'.removeEvilAttributes('\\1').'>'", $source); } /** * @return string * @param string * @desc Strip forbidden attributes from a tag */ function removeEvilAttributes($tagSource) { global $stripAttrib; return stripslashes(preg_replace("/$stripAttrib/i", 'forbidden', $tagSource)); } // Will output: <a href="forbiddenalert(1);" target="_blank" forbidden =" alert(1)">test</a> echo removeEvilTags('<a href="javascript:alert(1);" target="_blank" onMouseOver = "alert(1)">test</a>'); ?>