note 45429 added to function.preg-replace

A warning: if you are trying to sanitise dangerous html, as I was, you should know that recent versions of Mozilla will add an implicit closing > to an unterminated 'dodgy' tag. For example, the following is NOT good enough: $allowed='\s*\/?\s*(b|i|u|s|pre|tt|ul|ol|li|p|)\s*'; $memo=preg_replace("/<((?!($allowed>))[^<>]*)>/is", "&lt;\\1&gt;", $memo); An attacker can enter this: <B ONCLICK="window.open('http://www.example.com')" resulting in part of the site's own content suddenly becoming a link to example.com. I now use a second regexp to break any unterminated nasties: $memo = preg_replace('/<([^>]*)(?=(<|$))/',"&lt;\\1",$memo); ---- Manual Page -- http://www.php.net/manual/en/function.preg-replace.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+45429 Delete -- http://master.php.net/manage/user-notes.php?action=delete+45429&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+45429&report=yes Search -- http://master.php.net/manage/user-notes.php