Help with restricting preg_replace

bunner_bob

I can't figure out how to replace html special characters (such as "& amp;" or "& quot;") within a string, but ONLY when they occur between < and >. Is there a way, using preg_replace (or some other method) to do this?

I want to replace html special characters with their non-special equivalents (<, &, >) in each substring starting with < and ending with >, but not outside these delimiters.

Do I need to split out the sections starting with < and ending with >, and then do a preg_replace on them, or can I find these substrings within a larger block of text and do the replaces only within these sections?

Does this make any sense? I'll try to clarify it if not. Basically, I'm starting with text that's been encoded using htmlentities. I want to leave all the regular, human-readable text in html entity form, but I want to decode the angle brackets around html tags, and any special characters within those tags (like ampersands, doublequotes, etc.) so the tags and their contents will be correct html tag code, rather than html meant to be read as text.

If you have any ideas, they will be greatly appreciated!

Bob

Weedpacket

I'd probably do the preg_split() way at first; preg_split(/&(lt|gt);/) and then all the bits outside those parts will be in the even-numbered array entries, and all the bits inside will be in the odd-numbered....

I'm mildly sure it could be done with a single preg_replace arrays listing the special characters and their equivalents, and using assertions to say what must precede or follow the matched expression but I'm not in a position do do any experimentation right now, so don't hold me to that. In the meantime I'd be running with the split.

bunner_bob

I was figuring some sort of brute-force approach would be necessary. But I could be going about this the wrong way.

The big-picture operation is this:

admin user enters text into a textarea form field, including tags for bold, italic, and html links
this text (modified or not) gets stuffed into a database
text is retrieved for public display. Special characters like &, doublequote, accent characters are rendered as their html equivalents, but the angle brackets and stuff inside tags is left literal, so the tags work properly.

I think I need to convert characters BEFORE they're stuck in the db, because I'm worried that accent characters entered on PC will be different than when entered on Mac. I may be wrong about this though - haven't had a chance to test on PC yet. I suppose if they're the same I don't need to convert at all, but at some point the accent characters MUST be translated into html entities all the same.

Any idea of a different way to approach this?

Thanks

bunner_bob

OK - found this in the PHP manual, one of the comments. It works great except my doublequotes get converted to slash-ampersand-"quot"-semicolon - it's adding a slash before the ampersand, but only on converted quotes. Which suggests PHP is escaping the quote before it gets converted to html. But I can't seem to get a stripslashes in there anywhere that will have any effect.

I have magic quotes gpc on, but shouldn't I be able to stripslashes() somewhere in here?

The code:

$entities = implode('', preg_replace('/^([^<].+[^>])$/e', "htmlentities('\\1')", 
preg_split('/(<.+?>)/', $string, -1, 
PREG_SPLIT_DELIM_CAPTURE)));

Weedpacket

Originally posted by bunner bob
I have magic quotes gpc on, but shouldn't I be able to stripslashes() somewhere in here?

Yeah, stripslashes(htmlentities( or htmlentities(stripslashes( - I'm not sure which. Personally (because I'm not exactly enamoured with repeatedly escaping escape characters I use $1 instead of \1 but I doubt that has anything to do with it. Short answer though is you can put any code you want in the "replace" argument, though if it gets hairy you might want to consider preg_replace_callback instead (or at least write your own function and use that instead of htmlentities alone).