note 90944 deleted from function.bbcode-create by danbrown

Note Submitter: oxyrubber at yahoo dot com ---- @rothenbergxxx; 17-May-2009 12:29 The XHTML note is very true. This article's example appears to address this very issue: http://us3.php.net/manual/en/function.bbcode-set-flags.php One way to avoid some of the issue posed by rothenbergxxx is liberal use of only SPANs (or DIVs). Instead of using semantic tags (like STRONG, EM), use of generic SPAN tags with CSS could eliminate many of the XHTML DTD issues regarding BBCode. BBCode can be the source of many inadvertent and malicious injections to the HTML DOM (i.e. close tags where none were opened, use of double-quotes within a URL or IMG BBCode tag to escape the HTML attribute and create an attribute of the user's choice -- some of which are JavaScript-related). For security purposes, you should only allow the user to close tags which they opened (in the correct order) and to escape HTML special chars with a function like: http://us3.php.net/htmlspecialchars