Strip_string

by 8 replies
9
I have a site I am attempting to fine tune some third party code for. I want user profiles to be cleaner and so will need to allow some kind of HTML when users put them together. The code uses the following.

$username = $info2['provider_username'];
$joined = $info2['provider_joined'];
$name = strip_tags(stripslashes(substr($info2['provider_name'],0,200)));
$price = $info2['provider_price'];
$profile = strip_tags(stripslashes(substr($info2['provider_profile'],0,2000)));
 $types2 = explode(',', $info2['provider_types']);
$pictype = $info2['provider_pictype'];

I believe the bolded line is what I need to address. How can I modify this to allow a few tags like <BR> and <P>?
#programming #stripstring
  • the second argument for strip_tags is the allowed tags. See the documentation: strip_tags

    However, if this is being used on user supplied input, it is a very very bad idea to allow tags this way, because the strip_tags function has a fatal flaw: it will allow any attributes whatsoever to be added to the tags that are allowed. This is bad because users shouldn't be able to add stuff like onclick, onmouseover, etc, or else they'd be able to inject any script they want into the page. It is therefore advisable that you take a more robust approach. Here's a function I use:

    PHP Code:
    function strip_tags_attributes($string, $allowtags = '', $allowattributes = '') {
            $string = strip_tags($string, $allowtags);
        if(!empty(    $allowtags)) {//if no tags are allowed, all attributes are stripped anyway
                if(!is_array($allowattributes))
                    $allowattributes = explode(",", $allowattributes);
            if(    is_array($allowattributes))
                    $allowattributes = implode(")(?<!", $allowattributes);
            if (    strlen($allowattributes) > 0)
                    $allowattributes = "(?<!".$allowattributes.")";
                $char = (strlen($allowattributes) > 0) ? '[^ =\'\"]*' : ' ?[^ =]*';
                $string = preg_replace_callback("/<[^>]*>/i",create_function(
                    '$matches',
                    'return preg_replace("/'.$char.$allowattributes.'=(\"[^\"]*\"|\'[^\']*\'|[^>]*)/i", "", $matches[0]);'
                    ),$string);
        }
        return     $string;
    } 
    Use it like this:

    PHP Code:
      $safe_string = strip_tags_attributes($unsafe_string, '<br>'); 
    This will allow the "<br>" tag, but not allow any attributes. To allow some attributes, do something like this:

    PHP Code:
      $safe_string = strip_tags_attributes($unsafe_string, '<br><a>', 'style,href'); 
  • Rats. Was hoping for something simple a novice like myself could simply add to make this work. Already been to the link you added. Tried several variations but all I get are errors. Oh well. As it is, user profiles are just one long block of text without break.
    • [1] reply
    • It's not that hard, just define the function and use it instead of strip_tags.

      I see WF messed up my code though, I'll fix it.
  • You can use Download kses - PHP HTML/XHTML filter from SourceForge.net to do what you want. Kses is what WordPress uses to strip unwanted HTML.
    The zip contains examples etc. The readme contains a short code snippet which does what you need to do.
  • The other thing you could try, if all you want to do is turn newlines into <br> tags, is this:

    PHP Code:
    $profile = strip_tags(stripslashes(substr($info2['provider_profile'],0,2000)));
    $profile = str_replace("\n", '<br>', $profile); 
    This will replace all occurrences of newlines with BR elements.
    • [1] reply
    • Or you could simply use nl2br().

      Code:
      ...
 = nl2br();
      Okay, it seems like WarriorForum doesn't like certain PHP code.

      $profile = nl2br($profile);

      that's what should be in the Box above.
      • [1] reply
  • Works perfect Wayfarer. Thanks 10,000 times.
Join the discussion

Next Topics on Trending Feed

  • 9

    Strip_string

    I have a site I am attempting to fine tune some third party code for. I want user profiles to be cleaner and so will need to allow some kind of HTML when users put them together. The code uses the following. $username = $info2['provider_username'];