note 87956 added to function.strip-tags

I have a correction for mdw252's whitelist-based stripAttributes function. Using that function, if a user sends one of the following strings to the server, you get some undesired output, with varying levels of severity: 1. xss vulnerablities: <div onload..;,;.."xss.attack();">, <a href="javascript:xss.attack();">, <div onclick=";xss.attack();"> 2. some characters break the html: <div style="border:1px solid blue;"> I believe that the function below takes care of those issues and is a little more flexible by allowing some parameters. By default, the function will strip all attributes. So, you could sanitize a string this way: $string=stripAttributes($string); To acheive the same as mdw252's function, which is to allow the id and class attributes as well as href on links, you would: $allowable = array('class','id'); $exceptions = array('a'=>'href'); $string=stripAttributes($string,$allowable,$exceptions); Or, if you wanted to - allow the "class" and "style" attributes generally, - the "align" attribute only on table cells, and - specify possible values for the align attribute, you would: $allowable = array('class','style'); $exceptions = array('table'=>'width','td'=>'align'); $values = array('align'=>array('left','center','right')); $string=stripAttributes($string,$allowable,$exceptions,$values); <?php function stripAttributes($string, $allowable = NULL, $exceptions = NULL, $values = NULL, $nohrefevents= true, $crs=NULL) { $string=str_replace('..;,;..', '=', $string); if (!$crs) $crs = 'a-zA-Z0-9 \>\<\-:;\(\)\.\,\/=\&'; $string=preg_replace('/[^'.$crs.'\'"]/i','',$string); $string=preg_replace('/(<.*) (.*=)(['.$crs.']*) (.*>)/', '${1} ${2}"${3}" ${4}', $string); if ($nohrefevents) $string=preg_replace('/(<a .* )href="(javascript:.*>)/', '${1}onclick=${2}', $string); //generally allowed attributes if (is_array($allowable)){ foreach ($allowable as $allowed) $string=preg_replace('/(<.* )'.$allowed.'=(.*>)/', '${1}'.$allowed.'..;,;..${2}', $string); } //tag by tag exceptions if (is_array($exceptions)){ foreach ($exceptions as $tag=>$attribute){ $string=preg_replace('/(<'.$tag.' ?.* )'.$attribute.'=(.*>)/', '${1}'.$attribute.'..;,;..${2}', $string); } } //specified attribute values if (is_array($values)){ foreach ($values as $attribute=>$value){ if (is_array($value)){ foreach ($value as $val) while(preg_match('/(<.*) '.$attribute.'=(\'|")'.$val.'(\'|".*>)/', $string)) $string=preg_replace('/(<.*) '.$attribute.'=(\'|")'.$val.'(\'|".*>)/', '${1} '.$attribute.'..;,;..${2}'.$val.'${3}', $string); } } } while(preg_match('/(<.*) .*=(\'|")(['.$crs.']*)(\'|")(.*>)/', $string)) $string=preg_replace('/(<.*) .*=(\'|")(['.$crs.']*)(\'|")(.*>)/', '${1}${5}', $string); $string=str_replace('..;,;..', '=', $string); return $string; } ?> ---- Server IP: 193.190.67.16 Probable Submitter: 87.64.149.99 ---- Manual Page -- http://www.php.net/manual/en/function.strip-tags.php Edit -- https://master.php.net/note/edit/87956 Del: integrated -- https://master.php.net/note/delete/87956/integrated Del: useless -- https://master.php.net/note/delete/87956/useless Del: bad code -- https://master.php.net/note/delete/87956/bad+code Del: spam -- https://master.php.net/note/delete/87956/spam Del: non-english -- https://master.php.net/note/delete/87956/non-english Del: in docs -- https://master.php.net/note/delete/87956/in+docs Del: other reasons-- https://master.php.net/note/delete/87956 Reject -- https://master.php.net/note/reject/87956 Search -- https://master.php.net/manage/user-notes.php