note 34235 rejected from function.strip-tags by betz
| From: | betz@php.net | Date: | Sat, 19 Jul 2003 06:30:13 +0000 |
| Subject: | note 34235 rejected from function.strip-tags by betz | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-52375@lists.php.net to get a copy of this message | ||
Note Submitter: e@eikimartinson.c0m
----
"Warning: This function does not modify any attributes ..."
If only it were true! I am using strip_tags and allowing the <a> tag under sessions so that
secured users can enter links into a text box. While strip_tags does allow the a tag, it adds the
session identifier to the href parameter.
Input of '<a href="p.html">' yields '<a
href=p.html?PHPSESSID=foo">'.
Is there any way to correct this behavior?