Question

hopefully this is a simple question. I have a simple custom forum on my site written in PHP. For security reasons I don’t allow any HTML in the forum posts. I only allow certain BBCode tags. I would however like to allow embedded YouTube videos.

So my question is this: What’s the best (most secure) way to validate the YouTube embed code? YouTube is currently using iframes to embed videos, but obviously I can’t just allow the iframe tag. I also need to ensure the src of the iframe is a YouTube URL, and ensure there’s no other malicious bits of code in the iframe code.

Answer 1

You should allow users to use something like this:

[youtube]http://www.youtube.com/watch?v=te-TiL9YVaE[/youtube]

And then turn it to embed code using PHP when displaying a message:

function bb_youtube($post) {
    return preg_replace(
                            "#\[youtube].*?v=([^&]+).*?\[/youtube\]#im",
                            '<object width="480" height="385"><param name="movie" value="http://www.youtube.com/v/$1?fs=1"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/$1?fs=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="480" height="385"></embed></object>',
                            $post
                           );
}