note 90944 added to function.bbcode-create

@rothenbergxxx; 17-May-2009 12:29 The XHTML note is very true. This article's example appears to address this very issue: http://us3.php.net/manual/en/function.bbcode-set-flags.php One way to avoid some of the issue posed by rothenbergxxx is liberal use of only SPANs (or DIVs). Instead of using semantic tags (like STRONG, EM), use of generic SPAN tags with CSS could eliminate many of the XHTML DTD issues regarding BBCode. BBCode can be the source of many inadvertent and malicious injections to the HTML DOM (i.e. close tags where none were opened, use of double-quotes within a URL or IMG BBCode tag to escape the HTML attribute and create an attribute of the user's choice -- some of which are JavaScript-related). For security purposes, you should only allow the user to close tags which they opened (in the correct order) and to escape HTML special chars with a function like: http://us3.php.net/htmlspecialchars ---- Server IP: 209.41.74.194 Probable Submitter: 76.21.111.249 ---- Manual Page -- http://www.php.net/manual/en/function.bbcode-create.php Edit -- https://master.php.net/note/edit/90944 Del: integrated -- https://master.php.net/note/delete/90944/integrated Del: useless -- https://master.php.net/note/delete/90944/useless Del: bad code -- https://master.php.net/note/delete/90944/bad+code Del: spam -- https://master.php.net/note/delete/90944/spam Del: non-english -- https://master.php.net/note/delete/90944/non-english Del: in docs -- https://master.php.net/note/delete/90944/in+docs Del: other reasons-- https://master.php.net/note/delete/90944 Reject -- https://master.php.net/note/reject/90944 Search -- https://master.php.net/manage/user-notes.php