CODEWITHSUNDEEP
phpfiltering
Olivier Pons
Olivier Pons

Reputation: 15826

Php: remove all tags, but "a href" in a text

Here's my problem:

I have a textarea where the user can enter whatever he wants.

When he sends this text (POST method), on the server side I don't filter it at all before writing it into the database (because I want to keep "intact" what the user entered (maybe it can be used as a proof he tried to hack or whatever)).

Then, before outputting it, I use this function:

public function textForWeb($texte,$br=true)
{
  if ($br) {
    return
      mb_ereg_replace("((\r)?\n)", "<br />",
        htmlentities(
          stripslashes($texte),
          ENT_QUOTES, 'UTF-8'
        )
      );
  }
  else {
    return
      htmlentities(
        stripslashes($texte),
        ENT_QUOTES, 'UTF-8'
      );
  }
}

So the text is properly filtered and stays UTF-8 encoded.

But the problem is that I'd like all these text: <a href="http://url">xxx</a> to be untouched. I.e. when I will display it, the link (and only links with "http://" and no javascript inside) will be "clickable".

For example, you can see how it is displayed now here. See last line of the announce? I'd like the link to the website to be "clickable".

How would you do?

Upvotes: 0

Views: 2774

Answers (2)

Tom
Tom

Reputation: 3520

Just add a preg_replace() function to revert the escaped a tags after your htmlentities() function

$output = textForWeb($output);
$output = preg_replace('#&lt;a href=&quot;(?=https:\/\/|http:\/\/)(.*?)&quot;&gt;(.*?)&lt;/a&gt;#i', '<a href="$1">$2</a>', $output);

echo $output;

That way you can still escape all other HTML in a safe way (instead of using strip_tags() function.)

This preg_replace() function searches for a tags linking to pages starting with http:// or https:// and then replaces the escaped special characters with <, > and ", making the link clickable again.

Upvotes: 2

Nick
Nick

Reputation: 6346

When outputting surely you'd be better just using strip_tags and setting "a" to be an allowable element?

I.e.

$string = strip_tags($string,'<a>');

This would remove the tags instead of converting them to their entities though. It depends if you need it to convert everything apart from <a> tags into entities, or if you just want to remove the code.

Upvotes: 1

Related Questions