Re: [PHP4BETA] Re: strip_tags() and the recent CERT advisory....

On Fri, 4 Feb 2000, Stanislav Malyshev wrote: > TG>> memcpy(). But I'm not about to benchmark them :-) If anyone wants to do > TG>> that and post results, I'd be interested. > > Well, why not? Should take not much time... Will check it. Please CC me too cause I'm not subscribed... I got included cause I posted some code on php.net ;-) > TG>> However, htmlentities() only works with ISO-8859-1 character set. If the > TG>> browser in question is submitting data to the script in another character > TG>> set, htmlentities() does nothing to it, or worse, the wrong thing (because > TG>> it assumes its ISO-8859-1 even if it is not). > > In fact, I meant htmlspecialchars(), not entities. My fingers just typed > wrong function names, sorry. I think even, I don't really care for > anything except < (so I could just remove all <'s - it would effectively > disable HTML, IIRC, but I really want to be nice to users and do > something well-defined). In fact, the only question is doesn't some > browser recognise any other character as HTML tag start? Then, btw, > strip_tags won't work too, as I understand. I'm currently working on a patch to PHP 3.0.14 to strip out tags during parse of the GET/POST/COOKIE data, which will be configurable with a single statement at the top of a PHP script or in php.ini (like 'track_vars'). When I finish it I'll send it along... that will be more efficient than any code put into the script. As I'm not really using PHP4BETA which appears to be the topic of this email list, someone will have to port it or rewrite it for PHP4BETA users. --------------------------------------------------------------- | Tom Greer Jr | Phone (360)825-7225 | | System Operator | http://www.tx3.net/ | | Tx3 Online Services | email tomjr@tx3.net | ---------------------------------------------------------------