note 83042 deleted from function.strip-tags by danbrown
| From: | danbrown@php.net | Date: | Sun, 17 May 2009 15:53:36 +0000 |
| Subject: | note 83042 deleted from function.strip-tags by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-154708@lists.php.net to get a copy of this message | ||
Note Submitter: Massoud Abbagash
----
Danno, your script has a flaw.
Try this :
<?php
function strip_tags_keep_links($sSource)
{
return preg_replace('/<(.*?)>/ie', "'<' .
preg_replace(array('/javascript:[^\"\']*/i',
'/\b((?![hH][rR][eE][fF]\b)\w+)[ \\t\\n]*=[
\\t\\n]*[\"\'][^\"\']*[\"\']/i', '/\s+/'),
array('', '', ' '), stripslashes('\\1')) .
'>'", strip_tags($sSource,'<a>'));
}
$source = "<a href=javascript:alert('doesn\'t work!')
title=\"move your mouse here\" href=http://www.a_web_site.org
onmouseover\n=\nalert(\"doesn\'t work!\")
onmouseover='alert(\"doesn\'t work!\")' alt=\"move your mouse
here\" > test</a>";
$result=strip_tags_keep_links($source);
echo($result);
?>