note 82640 deleted from function.strip-tags by danbrown
| From: | danbrown@php.net | Date: | Sun, 17 May 2009 15:54:34 +0000 |
| Subject: | note 82640 deleted from function.strip-tags by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-154712@lists.php.net to get a copy of this message | ||
Note Submitter: LK
----
Concerning all of the notes about which attributes to include in strip_tags_attributes(), the latest
of which is by Kalle Sommer Nielsen:
Correct me if I'm wrong, but isn't it a lot easier to simply reject any attribute that
starts with "on"? Thus, the whole array of various javascript attributes could be replaced
with "on\w+".
I am not aware of any non-javascript attributes that start with these two letters, and if there
were, it would be easier to make an exception for them than for the countless JS attributes.