note 45429 deleted from function.preg-replace by nlopess

Note Submitter: Richard ---- A warning: if you are trying to sanitise dangerous html, as I was, you should know that recent versions of Mozilla will add an implicit closing > to an unterminated 'dodgy' tag. For example, the following is NOT good enough: $allowed='\s*\/?\s*(b|i|u|s|pre|tt|ul|ol|li|p|)\s*'; $memo=preg_replace("/<((?!($allowed>))[^<>]*)>/is", "&lt;\\1&gt;", $memo); An attacker can enter this: <B ONCLICK="window.open('http://www.example.com')" resulting in part of the site's own content suddenly becoming a link to example.com. I now use a second regexp to break any unterminated nasties: $memo = preg_replace('/<([^>]*)(?=(<|$))/',"&lt;\\1",$memo);