note 98612 added to function.strip-tags
| From: | phpnet at buzzhost dot co dot uk | Date: | Sat, 26 Jun 2010 09:01:53 +0000 |
| Subject: | note 98612 added to function.strip-tags | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-170485@lists.php.net to get a copy of this message | ||
the sample below by php at whizzaps dot com will max out & time out the server if a single <
(less than) sign is entered without a matching close. This function does *not* suffer from this
problem:
<?php
function StripHTML ($arg,$cleanup) {
//cleanup ==1 replace any stray less than /great than with alt html entities
//else leave as are
$allowed_tags = array('a','b','i','br', 'p',
'div', 'strong', 'em', 'ul', 'ol', 'li',
'dl', 'dd', 'dt');
$arg_length = strlen($arg);
if ($arg_length < 2) { return 0; }
$flipflop = 0;
for ($i = 0; $i <= $arg_length; $i++) {
$character = substr($arg, $i, 1);
switch ($character){
case "<":
if ($flipflop ==0){
$start_position = $i;
$flipflop = 1;
} else {
if ($cleanup==1) {
$buffer = "<" . substr($arg, ($start_position+1), (($i-$start_position)-1));
} else {
$buffer = "<" . substr($arg, ($start_position+1), (($i-$start_position)-1));
}
$output .= $buffer;
}
break;
case ">":
if ($flipflop ==0){
if ($cleanup==1) {
$output .= ">";
} else {
$output .= ">;";
}
}else{
$flipflop = 0;
$tmptagtext = trim($tagtext);
$tmp = explode(" ", $tmptagtext,2);
$tmptagtext = $tmp[0];
$tagtext = "<$tagtext>";
foreach ($allowed_tags as $value) {
if (($tmptagtext==$value)||($tmptagtext=="/$value")) {
$output .= "$tagtext";
}
}
$tagtext ="";
$tmptagtext = "";
unset($value);
}
break;
default:
if ($flipflop ==0) {
$output .= $character;
}
if ($flipflop ==1) {
$tagtext .= $character;
}
}
}
return $output;
}
?>
However, any javascript or other embeded content may still be abused as user input. This function
deals with that added menace:
<?php
function NoICT ($arg) {
$match = array(
// Remove invisible content
'@<head[^>]*?>.*?</head>@siu',
'@<style[^>]*?>.*?</style>@siu',
'@<script[^>]*?.*?</script>@siu',
'@<object[^>]*?.*?</object>@siu',
'@<embed[^>]*?.*?</embed>@siu',
'@<applet[^>]*?.*?</applet>@siu',
'@<noframes[^>]*?.*?</noframes>@siu',
'@<noscript[^>]*?.*?</noscript>@siu',
'@<noembed[^>]*?.*?</noembed>@siu',
'@</?((frameset)|(frame)|(iframe))@iu'
);
$arg = preg_replace($match, "", $arg);
return $arg;
}
?>
----
Server IP: 69.147.83.197
Probable Submitter: 212.69.52.158
----
Manual Page -- http://www.php.net/manual/en/function.strip-tags.php
Edit -- https://master.php.net/note/edit/98612
Del: integrated -- https://master.php.net/note/delete/98612/integrated
Del: useless -- https://master.php.net/note/delete/98612/useless
Del: bad code -- https://master.php.net/note/delete/98612/bad+code
Del: spam -- https://master.php.net/note/delete/98612/spam
Del: non-english -- https://master.php.net/note/delete/98612/non-english
Del: in docs -- https://master.php.net/note/delete/98612/in+docs
Del: other reasons-- https://master.php.net/note/delete/98612
Reject -- https://master.php.net/note/reject/98612
Search -- https://master.php.net/manage/user-notes.php