note 85718 deleted from function.strip-tags by danbrown

Note Submitter: mdw252 at psu dot edu ---- I think I may have come up with a pretty simple white-list based approach to attribute management. It's kind of hack-ish, but it's been pretty resilient with everything I've thrown at it. Check it out: function stripAttributes($string) { $string=preg_replace('/(<a.*)href=(.*>)/', '${1}href..;,;..${2}', $string); $string=preg_replace('/(<.*)id=(.*>)/', '${1}id..;,;..${2}', $string); $string=preg_replace('/(<.*)class=(.*>)/', '${1}class..;,;..${2}', $string); while(preg_match('/(<.*) .*=(\'|"|\w)\w*(\'|"|\w)(.*>)/', $string)) $string=preg_replace('/(<.*) .*=(\'|"|\w)\w*(\'|"|\w)(.*>)/', '${1}${4}', $string); $string=str_replace('..;,;..', '=', $string); return $string; } As you can see, I have it set to only allow href (in <a> tags), id, and class attributes, and everything else will be deleted. It should be pretty self-explanatory to customize it to your own purposes.