Differentiating between quotes

mrgrammar

I am setting up a form through which members of a site can submit their articles to me.

The member fills in a form where the textarea tag contains the article. When they click submit, they can view their article (much like a submission on a forum). Then they click the confirm button and the article is written to a file sitting on my server.

$pagename = "blah.php";
$artinc = "<h2>".$ftitle."</h2><p>".nl2br($farticle)."</p>";

$flname = $pagename;
$fp = fopen($flname , "w");
fwrite($fp , $artinc);
fclose ($fp);

The problem is that if the user submits an article with links or with quotes around phrases they might use, the quotes cause problems.

I need to disable all html/php code EXCEPT links to other sites, and I need to keep quote marks around phrases that need quotes.

I've looked at htmlspecialchars but I don't want to convert the links. I tried preg_replace but I couldn't make it differentiate between quotes within links and quotes in the text (which can be converted to quot; ).

Suggestions?

evi_one

<?php
	$text = 'Vivamus at felis. Maecenas "eget est" ac est porta "fringilla". Quisque <a href="http://www.somepage.tld/">adipiscing "mauris" quis</a> arcu. Integer nonummy elit "sit" amet erat.';
	$text = htmlspecialchars($text);
	$text = preg_replace('/&lt;a (.*?)&gt;/i', '<a $1>', $text);
	$text = preg_replace('^&lt;/a&gt;^i', '</a>', $text);
	$text = preg_replace('/&quot;(?=([^<]*>))/i', '"', $text);

echo $text;
?>

Of course there may be more logical ways, but I'm too tired right now to think of one nod

Edit: I don't know where the space between the ">" and the "))" in the second regex comes from. There shouldn't be any space there.

bradgrafelman

That's a bug in the forum I've experienced myself, evi|one.

He's talking about this:

$text = preg_replace('/"(?=([^<]*> ))/i', '"', $text);

needs to be

$text = preg_replace('/"(?=([^<]*>))/i', '"', $text);

evi_one

Right...

I made a small change in the code.

Replaced

$text = str_replace('&lt;/a&gt;', '</a>', $text);

with

$text = preg_replace('^&lt;/a&gt;^i', '</a>', $text);

The first one was case sensitive. If you have PHP5 you could use str_ireplace()