open html tags

open html tags

am 24.09.2007 16:35:32 von ffreino

Hi,
I have a web page where users can post messages and these are printed
on a board. Sometimes, when a user send a message with a open tag, for
example:

This is my message in bold and italic and this is a open
plain text. This might be a good idea even if you knew how to handle HTML
input.

> Sometimes, when a user send a message with a open tag, for
> example:
>
> This is my message in bold and italic and this is a open
> on the Internet, this means that disaster _will_ result. You haven't got
nasty viruses and <embed> annoyance and lots of <a> spam _yet_, I <br /> suppose.<br /> <br /> > I have tried to wrap messages in a <table>, <div> or <span> but this<br /> > problem persists.<br /> <br /> What made you think such tricks could possibly help?<br /> <br /> > Is there any way to avoid this?<br /> <br /> Do you really need the input possibility? Why? What does it contribute, <br /> really, that everyone and his dog and robot can puke on your page?<br /> <br /> If you really need it, does it need to allow HTML format?<br /> <br /> If yes, then stay tuned to some hard work. You would need to define the <br /> syntax of HTML you really want to accept (say, <b> is fine, <iframe> is not, <br /> etc.), parse the input to check that it is followed, and process it <br /> accordingly. You might be able to find existing software for this, but <br /> checking whether some software really does the job may well be more work <br /> than writing such software. (If you don't know how to write such stuff, in <br /> principle that is, then you're really not qualified to evaluate existing <br /> software in this issue, even at the simple level of deciding whether it's <br /> useful or yet another Troyan horse or something like that.)<br /> <br /> > I think I could fix the problem using<br /> > frames or something like that but I think there should be a smarter<br /> > way.<br /> <br /> Frames are part of a problem, not a solution.<br /> <br /> -- <br /> Jukka K. Korpela ("Yucca")<br /> http://www.cs.tut.fi/~jkorpela/</p> </article> <article> <h2>Re: open html tags</h2><span>am 24.09.2007 22:33:07 von Steven Saunderson</span> <p>On Mon, 24 Sep 2007 07:35:32 -0700, ffreino@gmail.com wrote:<br /> <br /> > Hi,<br /> > I have a web page where users can post messages and these are printed<br /> > on a board. Sometimes, when a user send a message with a open tag, for<br /> > example:<br /> > <br /> > This is my message in <b>bold</b> and <i>italic</i> and this is a open<br /> > <a href='http://domain<br /> <br /> Assuming that HTML comments are not allowed inside tags could you try<br /> putting  after the user input. This should fix an open tag<br /> but not necessarily an open element.<br /> <br /> -- <br /> Steven</p> </article> <article> <h2>Re: open html tags</h2><span>am 24.09.2007 22:42:07 von Harlan Messinger</span> <p>Steven Saunderson wrote:<br /> > On Mon, 24 Sep 2007 07:35:32 -0700, ffreino@gmail.com wrote:<br /> > <br /> >> Hi,<br /> >> I have a web page where users can post messages and these are printed<br /> >> on a board. Sometimes, when a user send a message with a open tag, for<br /> >> example:<br /> >><br /> >> This is my message in <b>bold</b> and <i>italic</i> and this is a open<br /> >> <a href='http://domain<br /> > <br /> > Assuming that HTML comments are not allowed inside tags could you try<br /> > putting  after the user input. This should fix an open tag<br /> > but not necessarily an open element.<br /> > <br /> Is that effective when there's an open single or double quote delimiting <br /> an attribute value?</p> </article> <article> <h2>Re: open html tags</h2><span>am 25.09.2007 08:20:56 von Steven Saunderson</span> <p>On Mon, 24 Sep 2007 16:42:07 -0400, Harlan Messinger<br /> <hmessinger.removethis@comcast.net> wrote:<br /> <br /> > Steven Saunderson wrote:<br /> > > Assuming that HTML comments are not allowed inside tags could you try<br /> > > putting  after the user input. This should fix an open tag<br /> > > but not necessarily an open element.<br /> > > <br /> > Is that effective when there's an open single or double quote delimiting <br /> > an attribute value?<br /> <br /> Good point; it probably won't work. I suppose the OP will have to<br /> validate everything or change all < to <.<br /> <br /> -- <br /> Steven</p> </article> <article> <h2>Re: open html tags</h2><span>am 25.09.2007 13:04:57 von ffreino</span> <p>Ok, I'll try to focus my problem ;)<br /> When an user posts a message, I use php function 'strip_tags' to allow<br /> only some tags.<br /> <br /> strip_tags($text, '<b><i><u><br><a><q><image>')<br /> <br /> I think I could use regex to close open tags but I would like to try<br /> something easier. Moreover, I must check open quotes and so on.<br /> I would like to try something easier and faster (and probably<br /> worse) :)<br /> I think I'll have to choose the hard and long way<br /> <br /> <br /> <br /> On 25 sep, 08:20, Steven Saunderson <phe...@Syd.au> wrote:<br /> > On Mon, 24 Sep 2007 16:42:07 -0400, Harlan Messinger<br /> ><br /> > <hmessinger.removet...@comcast.net> wrote:<br /> > > Steven Saunderson wrote:<br /> > > > Assuming that HTML comments are not allowed inside tags could you try<br /> > > > putting  after the user input. This should fix an open tag<br /> > > > but not necessarily an open element.<br /> ><br /> > > Is that effective when there's an open single or double quote delimiting<br /> > > an attribute value?<br /> ><br /> > Good point; it probably won't work. I suppose the OP will have to<br /> > validate everything or change all < to <.<br /> ><br /> > --<br /> > Steven</p> </article> <article> <h2>Re: open html tags</h2><span>am 26.09.2007 09:12:35 von Neredbojias</span> <p>Well bust mah britches and call me cheeky, on Tue, 25 Sep 2007 11:04:57<br /> GMT scribed: <br /> <br /> > Ok, I'll try to focus my problem ;)<br /> > When an user posts a message, I use php function 'strip_tags' to allow<br /> > only some tags.<br /> > <br /> > strip_tags($text, '<b><i><u><br><a><q><image>')<br /> > <br /> > I think I could use regex to close open tags but I would like to try<br /> > something easier. Moreover, I must check open quotes and so on.<br /> > I would like to try something easier and faster (and probably<br /> > worse) :)<br /> > I think I'll have to choose the hard and long way<br /> <br /> You'd be better off working from the other direction: change all input to <br /> text, then html-ize only those tags you want. I just got through doing a <br /> whole bunch of this stuff and it isn't particularly that bad. However, <br /> regex expressions are definitely a boon to the endeavor.<br /> <br /> -- <br /> Neredbojias<br /> Half lies are worth twice as much as whole lies.</p> </article> <footer> <a href="/">Index</a> | <a href="/impressum.php">Impressum</a> | <a href="/datenschutz.php">Datenschutz</a> | <a href="https://www.xodox.de/">XODOX</a> </footer> </main> </body> </html>