note 80427 deleted from function.strip-tags by danbrown
| From: | danbrown@php.net | Date: | Fri, 23 Sep 2011 16:04:09 +0000 |
| Subject: | note 80427 deleted from function.strip-tags by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-183380@lists.php.net to get a copy of this message | ||
Note Submitter: y5
----
An improved version of tREXX and Tony Freeman's code, this keeps the code clean while removing
unwanted attributes, including the javascript: protocol. Unlike the built-in strip_tags() function,
this takes an array for allowed tags, rather than a string. For example:
array('<a>', '<object>');
I don't understand why the built-in function uses a string.. oh well =)
<?php
function strip_tags_attributes($sSource, $aAllowedTags = array(), $aDisabledAttributes =
array('onclick', 'ondblclick', 'onkeydown', 'onkeypress',
'onkeyup', 'onload', 'onmousedown', 'onmousemove',
'onmouseout', 'onmouseover', 'onmouseup', 'onunload'))
{
if (empty($aDisabledEvents)) return strip_tags($sSource, implode('', $aAllowedTags));
return preg_replace('/<(.*?)>/ie', "'<' .
preg_replace(array('/javascript:[^\"\']*/i', '/(" .
implode('|', $aDisabledAttributes) .
")=[\"\'][^\"\']*[\"\']/i', '/\s+/'),
array('', '', ' '), stripslashes('\\1')) .
'>'", strip_tags($sSource, implode('', $aAllowedTags)));
}
?>