Help needed creating an HTML sandbox

schwim

Hi there everyone,

I need some help with designing an HTML sandbox. A place where my wife and her friends can test template code before putting it up on eBay. I have a couple of questions before I can even get started.

I've sanitized html before, but how would I submit HTML to a value if I want it to get preserved? Is there a way to do this, only stripping things that are used maliciously? I want it to have some checks in case it were made available to a less trustworthy person.

Any suggestions on how to store and regurgitate HTML without corruption or unintentional ending of the stored value(quotes ending it early) would be greatly appreciated.

thanks,
json

efficacious

well if its just a tool for your wife and friend to use.. why are you worried about it being used malicously?

efficacious

you might be able to use this function htmlentities() to keep your quotes intact then just plug it into a variable and use that variable for transpo

schwim

efficacious;10885294 wrote:
well if its just a tool for your wife and friend to use.. why are you worried about it being used malicously?

Because sometimes bad people find things that were meant for good people. Plus, it's the right way to code.

efficacious;10885294 wrote:
you might be able to use this function htmlentities() to keep your quotes intact then just plug it into a variable and use that variable for transpo

Thanks very much for your suggestion. It's what I'm currently using for my tests, but didn't know if that was all I needed to do to preserve any HTML that it might encounter.

thanks,
json

NogDog

Are you talking about saving HTML text to a database, or using a form to upload files and save them on the filesystem, or what?

bpat1434

I would use [man]strip_tags/man. [man]htmlentities/man (as well as [man]htmlspecialchars/man) will actually totally strip out all HTML tags, turning < into [noparse]<[/noparse] and > int [noparse]>[/noparse]. So that would be a detriment to what you're trying to accomplish.

Ebay allows only a select bit of HTML, so you can strip everything else out fairly easily. So I'd say strip the general bad stuff like javascript and meta tags, and then sanitize the rest as needed.

schwim

Hi there nogdog,

Eventually, it will get saved to a database. The way I'd like it to work is that someone can submit HTML and it will display in a frame below, then they can continue tweaking the HTML until they have what they like. They click "save" and it will provide them a URL like

http://www.domain.com/practiceboard.php?snippet=kdi038dkm2

and it will regurgitate the HTML that was saved. This will allow them to share a template with another. Of course after a set time, it would be cleared from the database.

Very sorry for the lack of description.

Hi there bpat:

Sorry for the confusion, but do you mean use strip_tags, while setting the allowable_tags? If I use this, I'll still need to use another method to preserve the HTML for storage, correct?

thanks,
json

bpat1434

what do you mean you'd need another method to preserve the html for storage? Just insert it into the database as a string. Wouldn't matter much what the content of the string is, just that it's a string.

And yes, you'd want to use the allowable tags parameter so that you can allow things like <strong> <em> <p> <br> and such.