HTML Filter Question

DarkTempest

I am working on a new CMS, and building it around a very tight security model. I want to be able to automatically strip all HTML tags from the incoming data that is posted to the core script, to be added to the database. Instead, I am planning on implementing a system of codes that can be used in its place, similar to BBCode, or vBCode. Each code tag would be controlled from the admin side as to whether or not it would be availible. I am also looking into designing a system to automatically follow the source of an image tag, and get its correct size and file type, so that it will properly show up, with a place holder before download, and to filter out any graphics other then PNG, JPG, and GIF. The down side, is I want the admin to have unrestricted ability to use either HTML or the CMS code system, as well as using a WYSIWYG plugin editor class for IE. Any thoughts / suggestions?

Mordecai

Well, I'm assuming that you're fairly knowledged in PHP to use this wisely. This is an HTML parser that I wrote, which could be used to change and/or use the format you can write:

$contents = ereg_replace("<|>","\n",$contents);
$lines = split("\n",$contents);
foreach ($lines as $line) {
  $line = trim($line);
  $spaced = split(" ",$line,2);
  $tag = $spaced[0];
  $params = split(" ",$spaced[1]);
  switch ($tag) {
    case "body": // tag 1
      for ($i=0;$i<=count($params);$i++) {
        $param_name = split("=",$params[$i]);
        $value = ereg_replace("#|\"|>","",$param_name[1]);
        switch ($param_name[0]) {
          case "bgcolor":
          // param 1
          break;
        }
      }
      // put stuff here that is used on the tag no matter what params
      break;
  }
}

Note: $contents is the HTML page. It'll be delimited into multiple lines and then read as HTML tags.

Hope this helps.

DarkTempest

Thanks Mordecai...

I am not super at PHP... Which is one of the reasons I agreed to under take the CMS project from the group of my friends who proposed some of the specs for it... I learn better by doing... I had planned on using the strip_tags function in PHP to just wipe all incoming tags, from the submitted data, but as I thought about it, doing so would wipe out the tags from the IE WYSIWYG editor as well as those from a user doing it by hand. I am already using sessions, to allow me to identify each user, and a cookie and .htaccess system to identify admins, so that I can seperate thier posts from the general ones.

Your reply though, has given me a few ideas to work with though...

As a secondary thought... Does anyone know if any of the freely availible WYSIWYG editor classes, whether written direct in PHP, or in Javascript either have an identifier that I can use to indicate where the data came from, as in a regular post from the form, or from the editor, or is there a way to re-write the editor so that it's function is maintained, yet when it sends its data to the core, it sends it using the CMS code, instead of HTML?