note 82937 deleted from function.strip-tags by danbrown
| From: | danbrown@php.net | Date: | Sun, 17 May 2009 15:54:03 +0000 |
| Subject: | note 82937 deleted from function.strip-tags by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-154710@lists.php.net to get a copy of this message | ||
Note Submitter: bluej100@gmail
----
Allowing user HTML while preventing XSS is non-trivial. Don't just try to hack together a
regexp for it; at very least, check your solution against all of the ha.ckers.org exploit examples:
http://ha.ckers.org/xss.html
Really, though, you should be using a solid library that recognizes tags, attributes, and styles
from a whitelist and rebuilds the markup from scratch. HTMLPurifier has a "linkify" option
that does what you're looking for.
http://htmlpurifier.org