Question

Could someone tell me why this isn’t working please?

$str = preg_replace("<font[^>]*>", '', $str);

CMS is for flash and now the client wants to implement a html website. Need to remove evil inline font tags to show default styling.

Answer 1

if you want to use preg_replace have a look on this function
(in this link you will found a lot of function to do this : http://php.net/manual/en/function.strip-tags.php)

Here is support for stripping content for the reverse strip_tags function:

<?php
function strip_only($str, $tags, $stripContent = false) {
    $content = '';
    if(!is_array($tags)) {
        $tags = (strpos($str, '>') !== false ? explode('>', str_replace('<', '', $tags)) : array($tags));
        if(end($tags) == '') array_pop($tags);
    }
    foreach($tags as $tag) {
        if ($stripContent)
             $content = '(.+</'.$tag.'[^>]*>|)';
         $str = preg_replace('#</?'.$tag.'[^>]*>'.$content.'#is', '', $str);
    }
    return $str;
}

$str = '<font color="red">red</font> text';
$tags = 'font';
$a = strip_only($str, $tags); // red text
$b = strip_only($str, $tags, true); // text
?>