How to safely allow embedded YouTube videos?

[Jake Bunce]

I don't see any risks since the movie location is prefixed with a hard coded part. That means you can only load YouTube movies as opposed to other embedded content.

[ComputerVitals]

If you dont want the whole video showing.. (I dont) you can put it in a nice drop down.

Found here:
http://www.vbulletin.com/forum/showthread.php?t=199345

[Viper007Bond]

Thought I'd share the code I used. I'm new to vB, so I may have done this wrong as I made two BBCode entires -- one for the simple, one for the advanced.

Simple Method:

[youtube]hl2UUunlI2Q[/youtube]

<table class="tborder" cellpadding="6" cellspacing="1" border="0" width="466">
 <tr><td style="text-align:center"><strong><a href="http://www.youtube.com/watch?v={param}" target="_blank">YouTube Video</a></strong></td></tr>
  <tbody><tr><td class="alt1" align="center"><object width="425" height="350" type="application/x-shockwave-flash" data="http://www.youtube.com/v/{param}"><param name="movie" value="http://www.youtube.com/v/{param}" /><param name="wmode" value="transparent" /><em><strong>ERROR:</strong> If you can see this, then <a href="http://www.youtube.com/">YouTube</a> is down or you don't have Flash installed.</em></object></td></tr></tbody>
</table>

Advanced Method (pick a title):

[youtube=hl2UUunlI2Q]Aston Martin Crash[/youtube]

<table class="tborder" cellpadding="6" cellspacing="1" border="0" width="466">
 <tr><td style="text-align:center"><strong><a href="http://www.youtube.com/watch?v={option}" target="_blank">"{param}" via YouTube</a></strong></td></tr>
  <tbody><tr><td class="alt1" align="center"><object width="425" height="350" type="application/x-shockwave-flash" data="http://www.youtube.com/v/{option}"><param name="movie" value="http://www.youtube.com/v/{option}" /><param name="wmode" value="transparent" /><em><strong>ERROR:</strong> If you can see this, then <a href="http://www.youtube.com/">YouTube</a> is down or you don't have Flash installed.</em></object></td></tr></tbody>
</table>

Example Result:

[twobob]

Hi Guys ... this thread got me thinking about embedding googlemaps within threads ....

I have created a map using an awesome site www.quickmaps.com

The site gives me code to include on my site:

 
<iframe src="http://www.quikmaps.com/ext/15970?w=...332&zl=16&mt=0" frameborder="0" scrolling="no" width="781" height="493" marginwidth="0" marginheight="0"></iframe>

How could I create a Custom BB Code that would allow my members to post their map within a post .... ie using a [map] beginning and close if they copy the bit from ext/ ... =0. Any tips?

Many thanks! .... twobob

[Jake Bunce]

It's the same idea. Just replace the URL with {param} in the replacement code, like so:

<iframe src="{param}" frameborder="0" scrolling="no" width="781" height="493" marginwidth="0" marginheight="0"></iframe>

Then you can use code like this in a post:

[map]http://www.quikmaps.com/ext/15970?w=779&mh=465&t=1&ln=0&sn=1&zb=0&zs=0&d=1&it=0&icd=0&lat=-33.88543337775272&lng=151.2297248840332&zl=16&mt=0[/map]

[Weirdwolf]

This is an awesome little code. My members will love it, I'm sure! Thanks!

[pictureboarduk]

This is fantastic, I have the little icon showing in the 'Start a thread' option, but it is'nt showing in Quick Reply.

How do you add the icon to Quick Reply?

Thanks! Great info.

[pictureboarduk]

Is it possible to have the icon show in the quick reply box aswell?

thanks.

[Wayne Luke]

Is it possible to have the icon show in the quick reply box aswell?

thanks.

This would require modifying the code. You should ask at www.vbulletin.org.

[PcosKat]

Is it better to use BB code rather than simply pasting the youtube embed code directly into a post?

[feldon23]

Is it better to use BB code rather than simply pasting the youtube embed code directly into a post?

That would only work if you allow your users to post straight HTML, which would expose you to users posting Javascript, ActiveX controls, etc. They could use Javascript to rewrite all the links on your page to send traffic to their site, steal user information, etc.

[PcosKat]

That would only work if you allow your users to post straight HTML, which would expose you to users posting Javascript, ActiveX controls, etc. They could use Javascript to rewrite all the links on your page to send traffic to their site, steal user information, etc.

Thanks for that, Feldon!

I don't think the users of my big board would do that (it's not a tech savvy board), but I'll keep that in mind for future boards...

Kinda scary!

[Wayne Luke]

Thanks for that, Feldon!

I don't think the users of my big board would do that (it's not a tech savvy board), but I'll keep that in mind for future boards...

Kinda scary!

People looking to deface and hack forums will specifically target forums with HTML enabled.

There is a new addon that builds the embed links for you at vBulletin.org. It doesn't require BBCodes.

[PcosKat]

People looking to deface and hack forums will specifically target forums with HTML enabled.

There is a new addon that builds the embed links for you at vBulletin.org. It doesn't require BBCodes.

Thanks Wayne - I'll head over to find that add on.

[gr8tfate]

You can use the embed code on YouTube's site to make a BB code:

Admin CP -> Custom BB Codes -> Add New BB Code

Title - YouTube
Tag - youtube
Replacement:

<object width="425" height="350"><param name="movie" value="http://www.youtube.com/v/{param}"></param><embed src="http://www.youtube.com/v/{param}" type="application/x-shockwave-flash" width="425" height="350"></embed></object>

Example - [youtube]JFwCCL0Vh6U[/youtube]

Description - Use the movie code from the YouTube URL in your browser. For example, http://youtube.com/watch?v=JFwCCL0Vh6U

Damn, I know this is my first day and all, but I must be a dumbass or missing something, b/c the BB Code doesn't work I set it in the BB Code Manager.

What could I be doing wrong?