BBCODE hole, insertion of malicious styles

Question

I have a system to parse BBCODE to HTML tags. But I have a problem. When I insert color the users can put also other styles. For Example:

[color=green;font-size:100px]green text[/color]

In this way the users can insert to the chat big words, it isn't good. My parsing system --> source

What's the solution?

Answer 1

For a quick fix you can replace the line

'/\[color=(.*?)\](.*?)\[\/color\]/is',

with

'/\[color=([^;]*?)\](.*?)\[\/color\]/is',

This way it won't match on color-tags including a ;, but still whatever the user enters behind = will be in the <span>-tag.

Another option (which may require more work) is to allow only certain colors:

'/\[color=(#\d{6}|green|blue|red|black)\](.*?)\[\/color\]/is',

This will allow hex colors (like #000000) and green, blue, red and black... you're free to add other colors.