Re: [PEPr] Comment on HTML::HTML_Safe
| From: | Pierre-Alain Joye | Date: | Sun, 30 Jan 2005 13:46:39 +0000 |
| Subject: | Re: [PEPr] Comment on HTML::HTML_Safe | ||
| References: | 1 2 3 | Groups: | php.pear.dev |
| Request: | Send a blank email to pear-dev+get-35801@lists.php.net to get a copy of this message | ||
On Sun, 30 Jan 2005 16:19:56 +0300
kukutz@gmail.com (Roman Ivanov) wrote:
> > Are you familliar with PHP's strip_tags function?
>
> Of course, I'm familiar with it.
>
> HTML_safe has those differences with strip_tags():
> 1. strip_tags works on white-list basis, deleting all tags except
> allowed. HTML_Safe works on black-list basis, deleting only
> dangerous content.
I only took a quick look to your code and this thread, however I'm
not sure that the black list basis is a good idea. You know what is
safe, you do not know what is not or will not be (especially what
will not be ;). So maybe allows both black and white modes?
--Pierre