Php And Disabling Html Tags

shadowx

Jun 1 2006, 01:01 PM

Hello everyone

Im TRYING to make a forum and obviously for security i need to disable HTML tags being used in posts. i know how to use the str_replace() function but to be honest i think id have to do that for every single tag. I also trued using the html

CODE

<XMP> stuff </XMP>

tag but i need to be able to use the new line tag to make a new line as all the posts are stored as HTML. if this isnt clear let me give an example:

QUOTE

NEW POST PAGE > user makes new post and posts it > PHP PROCCESSOR PAGE MAKES HTML FILE > NEW HTML FILE CONTAINING THE POST > user veiws the post using a php page to retrieve the html and display it

hopefully that explains it better. so unless i can find another way of putting lnie breaks into the mesage i need to disable all html tags except the new line tag. im begining to think that html might not be ideal for storing the message data, but i was sure that an sql table had a character limit of 255 characters or am i wrong?

Thanx in advanced

Comment/Reply (w/o sign-up)

rvalkass

Jun 1 2006, 04:22 PM

Virtually ever single forum script out there uses a database, whether that be MySQL, SqLite, PostgreSQL or another system. As far as I am aware there isn't a character limit of 255 on things like the TEXT datatype in MySQL. This is how most forums store their post content, and it allows you to have long posts with no character limit, although many forums impose a character limit due to database size restrictions.
As for the removing HTML tags, your best bet would be to remove all tags, so < anything > and then replace a linebreak with a special character, like the ¦ symbol. Then when you load the post, remove that symbol and replace it with a linebreak tag. If not then look at some tutorials or other forum scripts and see how they do it.

Comment/Reply (w/o sign-up)

shadowx

Jun 1 2006, 06:42 PM

QUOTE(rvalkass @ Jun 1 2006, 05:22 PM)

Virtually ever single forum script out there uses a database, whether that be MySQL, SqLite, PostgreSQL or another system. As far as I am aware there isn't a character limit of 255 on things like the TEXT datatype in MySQL. This is how most forums store their post content, and it allows you to have long posts with no character limit, although many forums impose a character limit due to database size restrictions.
As for the removing HTML tags, your best bet would be to remove all tags, so < anything > and then replace a linebreak with a special character, like the ¦ symbol. Then when you load the post, remove that symbol and replace it with a linebreak tag. If not then look at some tutorials or other forum scripts and see how they do it.

Humm...i might give the database idea a go it would savea lot of hassle i guess it just made me think also with this forum that it seems to have each post stored as a HTML file, if you look at the address bar its topicname12345.html where 12345 is a random number.

I shall try using the database and such i think. God knows where i got the idea of a character limit then!

thanx

Comment/Reply (w/o sign-up)

electriic ink

Jun 1 2006, 06:53 PM

The topics aren't stored as html pages but in databases as rvalkass mentioned. The links to html pages that you see on the D2-Latest Topics Mod at the bottom and everywhere else are all virtual and are formed, somehow, using apache. To prove that they aren't proper pages but virtual, visit the URL below:

http://www.trap17.com/forums/HEY_LOOK_I_CA...URL-t37546.html

.

As for trying to stop people utilising html, try this code:

CODE

<? $post = str_replace ('<', '<', $post); $post = str_replace ('>', '>', $post); ?>

And for making new lines in the textbox turn into <br />

CODE

<? $post = nl2br ($post); ?>

To make it so that the break tag appears in HTML format rather than XHTML format, add the following code afterwards:

CODE

<? $post = str_replace ('<br />', '<br>', $post); ?>

$post being whatever the variable containing the post's data is and < and > are the ASCII codes for < and > so they won't render as html.

Comment/Reply (w/o sign-up)

arcticsnpr

Jun 1 2006, 07:03 PM

i think all your looking for is one small funcion:

CODE

htmlspecialchars(data);

I'm not sure if this is what you are looking for, but what this does is takes any html tags and puts them into english, so it will print out the html.
, arctic

Comment/Reply (w/o sign-up)

shadowx

Jun 1 2006, 09:14 PM

thanks for that electriic ink it makes sense, i think ill use a database and some of the functions below to strip the HTML and then do it that way.

i learn something new every day! stil lhave no idea how i got the whole 255 character limit thing from though...it puzzled me how forums worked i just assumed they used some kind of file to store the data in, now i know differently!

Comment/Reply (w/o sign-up)

Spectre

Jun 1 2006, 09:54 PM

Little off-topic, but Trap17's method could be repeated using Apache's mod_rewrite (I'm not 100% sure what path Trap17 takes, but I'm assuming it would similar to this):

CODE

RewriteRule ^/?forums/(.*)-t([0-9]*)\.html$ /path/script.php?tid=$2 [L,QSA]

This completely disregards the actual path, only taking into consideration the numbers which appear after the '-t' and before the '.html', and passing that value onto '/path/script.php' which can then do with it as it will. This URL rewriting is done on Trap17 purely for SEO purposes; there are many other things you could use it for, though.

Comment/Reply (w/o sign-up)

BuffaloHELP

Jun 1 2006, 11:15 PM

Regretfully going off topic here.

Trap17's forum, Invision, has built-in "disable HTML tags" under admin control. However, I'm sure when the admin's control is triggered it uses some reliable stripping method to cancel out the < html command > and post it as plain text.

Comment/Reply (w/o sign-up)

beeseven

Jun 1 2006, 11:36 PM

arcticsnpr is right, htmlspecialchars or htmlentities will convert < and > to < and >. It will also convert other things which you can find here: http://us2.php.net/manual/en/function.htmlentities.php

Comment/Reply (w/o sign-up)

Tyssen

Jun 2 2006, 02:23 AM

If you want to remove all HTML, you can use the strip_tags function: http://au3.php.net/strip_tags

Comment/Reply (w/o sign-up)

Php And Disabling Html Tags - how can i do this?

Php And Disabling Html Tags - how can i do this?

Latest Entries