Is it possible to eliminate HTML in Echo

[VooDooRT]

I want to be able to ignore all html calls within an echo statement. I plan to keep a large amount of information (like a new article) in a SQL database. What I don't want, are malicious users posting bogus or damaging html code into the database, that when echo'd back out, will cause problems for the website. So, is it possible to eliminate all html parsing within an echo statement?

I would think there would be an easy way around it of course.

Basically, the same way phpbb or other BBs do it.

[LordShryku]

Could use strip_tags. Or a preg_replace like preg_replace('/[^{a-zA-Z0-9_]/',} '', $stuff);

[VooDooRT]

That's an awful lot of tags though isn't it?

[LordShryku]

Is it just certain tags you want to eliminate? Those options will eliminate all tags

[VooDooRT]

I would actually rather just have them echo'd out...like:

<img src="source">

Instead of showing the image, it will actually display the code above.

[krelian]

Just replace the actual > with > instead. You want the echo out to be viewed like source code correct?

$string = str_replace(">",">",$string);

That should eliminate it for you while retaining the structure of the string.

[dta]

on a different note, you might want to allow the users to use the basic garbage html. (read: b,i,u) so just use the bb-workaround with something like:

$a=array(
	"~\[b.\](.*?)\[/b.\]~i"=>"<b>$1</b>\n",
 //remove the . from [b.] and [/b.]
	"~\[s\](.*?)\[/s\]~i"=>"<s>$1</s>\n",
	"~\[img=(.*?)\](.*?)\[/img\]~i" => "<img src=$1 alt=$2>\n",	
	"~\[link=(.*?)\](.*?)\[/link\]~i" => "<a href=$1>$2</a>\n",	
	"~\[br\]~i"=>"<br>\n",
	"~=\(~i" => "(sad)",
	"~=\)~i" => "(happy)"
);

preg_replace (array_keys($a), array_values($a), $text);

if you take this route, just kill the <script tags and other such harmful tags (not to mention the downright evil tags such as marquee.)

[VooDooRT]

I've got all them to work except:

$report = str_replace("[link=(.*?)](.*?)[/link]","<a href=$1>$2</a>",$report);
$report = str_replace("[img](.*?)[/img]" ,"<img src=$1>",$report);

Am I retarded, or am I doing something wrong...lol

[VooDooRT]

this is working, all except the LINKS and IMAGES part. Ideas?

$a = array(">", "<", "[b]", "[/b]", "[i]", "[/i]", "[center]", "[/center]", "[u]", "[/u]", "[link=(.*?)](.*?)[/link]", "[img](.*?)[/img]");
$b = array("&gt;", "&lt;", "<b>", "</b>", "<i>", "</i>", "<center>", "</center>", "<u>", "</u>", "<a href=$1>$2</a>", "<img src=$1>");
$description = str_replace($a,$b,$description);

[dta]

these work fine, i didnt try it with str_replace though

$report = preg_replace("/\\[link=(.*?)](.*?)\\[\\/link]/i","<a href=$1>$2</a>",$report); 
$report = preg_replace("/\\[img](.*?)\\[\\/img]/i" ,"<img src=$1>",$report);

[VooDooRT]

Still not working.

[VooDooRT]

Top