HTML 입력 제한 텍스트 상자에 제한

Question

사용자가 텍스트 상자에 입력 할 수있는 HTML 유형을 어떻게 제한합니까? 베타 테스트를하는 몇 가지 사용자 정의 소프트웨어를 사용하여 작은 포럼을 실행하고 있지만 HTML 입력을 제한하는 방법을 알아야합니다. 제안이 있습니까?

Answer 1

i'd suggest a slightly alternative approach:

• don't filter incoming user data (beyond prevention of sql injection). user data should be kept as pure as possible.
• filter all outgoing data from the database, this is where things like tag stripping, etc.. should happen

keeping user data clean allows you more flexibility in how it's displayed. filtering all outgoing data is a good habit to get into (along the never trust data meme).

Answer 2

You didn't state what the forum was built with, but if it's PHP, check out:

http://htmlpurifier.org/

Library Features: Whitelist, Removal, Well-formed, Nesting, Attributes, XSS safe, Standards safe

Answer 3

Once the text is submitted, you could strip any/all tags that don't match your predefined set using a regex in PHP.

It would look something like the following:

find open tag (<)
if contents != allowed tag, remove tag (from <..>)

Answer 4

1. Parse the input provides and strip out all html tags that don't match exactly the list you are allowing. This can either be a complex regex, or you can do a stateful iteration through the char[] of the input string building the allowed input string and stripping unwanted attributes on tags like img.

2. Use a different code system (BBCode, Markdown)

3. Find some code online that already does this, to use as a basis for your implementation. For example Slashcode must perform this, so look for its implementation in the Perl and use the regexes (that I assume are there)

Answer 5

Regardless what you use, be sure to be informed of what kind of HTML content can be dangerous.

e.g. a < script > tag is pretty obvious, but a < style > tag is just as bad in IE, because it can invoke JScript commands.

In fact, any style="..." attribute can invoke script in IE.

< object > would be one more tag to be weary of.

Answer 6

PHP comes with a simple function strip_tag to strip HTML tags. It allows for certain tags to not be stripped.

Example #1 strip_tags() example

<?php
$text = '<p>Test paragraph.</p><!-- Comment --> <a href="#fragment">Other text</a>';
echo strip_tags($text);
echo "\n";

// Allow <p> and <a>
echo strip_tags($text, '<p><a>');
?>

The above example will output:

Test paragraph. Other text
<p>Test paragraph.</p> <a href="#fragment">Other text</a>

Personally for a forum, I would use BBCode or Markdown because the amount of support and features provided such as live preview.