This is a discussion on Extending strip_tags() for allowing certain html tags within the PHP General forums, part of the PHP Programming Forums category; I found some code at http://marc.theaimsgroup.com/?l=php-...2414231212&w=2 that was meant to extend ...
|
|||||||
| FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
|
|||
|
I found some code at
http://marc.theaimsgroup.com/?l=php-...2414231212&w=2 that was meant to extend strip_tags() where it wouldn't be blindly prone to XSS attacks via tag attributes. Unfortunately, that code works too good. If one were to pass a legal <img> tags like <img src="http://us2.php.net/images/php_snow.gif" /> It gets reduced to <img> Does anyone have any suggestions on how to modify that code (or any code), where one is bypassing certain tags, while keeping those certain tags "safe" (as safe as one can be) Thanks for you suggestions. |
![]() |
| Thread Tools | |
| Display Modes | |
|
|