Question

I am taking input from user where i want to ban few html tags like , and also want to ban attributes like onclick, onmousemove, onmouseover etc

also user still be able to write programming language code like html php jQuery for discussion. but it should not run

please guide me

Answer 1

Here is a function I’ve used that you can tailor to your needs.

function strip_unsafe($string, $img=false)
{
    // Unsafe HTML tags that members may abuse
    $unsafe=array(
    '/<iframe(.*?)<\/iframe>/is',
    '/<title(.*?)<\/title>/is',
    '/<pre(.*?)<\/pre>/is',
    '/<frame(.*?)<\/frame>/is',
    '/<frameset(.*?)<\/frameset>/is',
    '/<object(.*?)<\/object>/is',
    '/<script(.*?)<\/script>/is',
    '/<embed(.*?)<\/embed>/is',
    '/<applet(.*?)<\/applet>/is',
    '/<meta(.*?)>/is',
    '/<!doctype(.*?)>/is',
    '/<link(.*?)>/is',
    '/<body(.*?)>/is',
    '/<\/body>/is',
    '/<head(.*?)>/is',
    '/<\/head>/is',
    '/onload="(.*?)"/is',
    '/onunload="(.*?)"/is',
    '/<html(.*?)>/is',
    '/<\/html>/is');

    // Remove graphic too if the user wants
    if ($img==true)
    {
        $unsafe[]='/<img(.*?)>/is';
    }

    // Remove these tags and all parameters within them
    $string=preg_replace($unsafe, "", $string);

    return $string;
}