htmlspecialchars and tags

Anon

I have a document collaboration project I'm working on, and I'd like to be able to leave SOME HTML tags in the input stream, but convert everything else.

Something like "striptags" that would go something like this

SuperHTMLSpecialChars($input_stream, "BR", "HR", "B", "U", "I");

Which would ignore the tags listed. Is there anybody who's done this or anything like it, or a class or something written that'd perform a similar function?

As always, thanks for the help!

-Ben

yelvington

Read the section of the manual entitled "string functions," where you will find a function that does exactly what you describe.

Anon

Where? I went to this URL:

http://www.php.net/manual/ref.strings.php

and the closest I can find is htmlspecialchars and htmlentities - neither of which does what I need.

Do you have more detail(s) on this?

Thanks,

Ben

yelvington

Look again; strip_tags().

Anon

The issue here is NOT that I'm trying to strip tags, but rather to KEEP tags in an input stream tags but use htmlspecialchars on everything else.

The following examples assume the following input:

$var="this is <BR> something that </table> I like, because 1 < 2";

I can use striptags something like this

$var=striptags($var, "BR");

and keep the BR, stripping out the nasty /table tag. So, all's well there, and I keep the page layout safe. But...

If I want to use htmlspecialschars to preserve the "1 < 2" sequence, I then lose the use of the BR tag... it's rendered on screen rather than used.

And, THATs the problem I want to solve - use htmlspecialchars so that I can see less than/greater than signs and others of its ilk but still keep actual HTML tags in use.

-Ben

Anon

Also, I'd want to prevent javascript attacks and things like that - so if I allow a few tags, and turn EVERYTHING ELSE into quoted chars with htmlspecialchars, such attacks are mitigated.

-Ben