How to strip tags from HTML in posts?

[Parker Clack]

I want to allow my members to use certain HTML tags in their posts but strip things like embed, script, etc. from the post before it gets posted.

Is there any thing you can had to the allowhtml routine in the script that would check for these tags and strip them from the newthread, reply and edit messages that get posted?

What would you put and what files would you modify?

Parker

[zahrani]

I'm having the same problem, would some one help?

[Steve Machol]

Wow - you've resurrected a thread that was over a year old!

You could try using replacement variables to strip HTML tags. For instance you could set it up so that:

<javascript

...would be replaced by:

<**********

Of course you would need to do this for every concievable tag that could present a threat. That might be difficult to do since new threats are uncovered all the time.

Conversely you could try to look over at vbulletin.org for a hack to accomplish the same thing. I'm not sure if there is one, but you can check and see.

[rylin]

strip_tags() is your friend

strip_tags -- Strip HTML and PHP tags from a string
Description
string strip_tags ( string str [, string allowable_tags])


This function tries to return a string with all HTML and PHP tags stripped from a given str. It errors on the side of caution in case of incomplete or bogus tags. It uses the same tag stripping state machine as the fgetss() function.

You can use the optional second parameter to specify tags which should not be stripped.

Note: allowable_tags was added in PHP 3.0.13 and PHP 4.0b3.

http://www.php.net/manual/en/function.strip-tags.php

[Chen]

Or you can add <javascript to your censored words list. And lo and behold, here's a full list of tags you should censor:

http://vbulletin.com/forum/showthread.php?s=&threadid=36504

[tubedogg]

<javascript> is never allowed even if HTML is turned on, IIRC.

[Chen]

Originally posted by tubedogg
<javascript> is never allowed even if HTML is turned on, IIRC.

Nope, it's javascript: that gets split (and becomes javascript:).