Secutity with form submissions

[Anon]

What would I do to warn people who are submitting info into a forum for example, that their html is broken? but still let them use <img src>, links, and font types like <b> and <i> ?

becuase just a little broken comma can screw everything up!

[[deleted]]

A common way is to not allow any HTML to be uploaded.
Instead, use a few custom tags that you translate into html when the data is posted to the forum.
You can get rid of any html with striptags() etc.

[parena]

Exactly... use the well-known Ultimate Bulletin Board tags or something like that:

[link]linkfromuser[/link]

something like that...

[[deleted]]

[parena]bollocks[/parena] 🙂

[kparker]

UBB doesn't remove the worry over unbalanced tags. If you're going to translate into &lt;b&gt; and into &lt;/b&gt; you still have to worry that the user forgot to put [/b] after every .

[cordex]

True. You could, however, do a count of each type and subtract the number of closing tags from the number of open tags. Anything not equal to zero has issues.

The count wouldn't be too hard either..

-Ben

[[deleted]]

Yes but then it's in your control, and you can easily fix that.

[kparker]

You still have to worry about incorrect things like this:

&nbsp;&nbsp; something here

[kparker]

Umm, when dealing with the text that comes to you via a POST, what difference does it make whether you're matching up and or &lt;b&gt; and &lt;/b&gt;? Either way, you have to do the check, and either way, it's not a problem until you turn around and use the uploaded text as part of your html output somewhere.

[parena]

No you don't. It's crappy HTML, but it works...

[[deleted]]

The diff is that using your own tags, you can discard any and all HTML tags,
which is slightly easier than removing all but a few HTML tags.

Plus, you can replace the custom tag with lots more than just <B>, you could put a css tag in it's place.

And you can create tags like [header] and replace them with the font tag that creates the header style.

All in all it's a lot easier than sifting through tons of html tags trying to change fonts tags to something that matches your website's style.

[Anon]

And Vincent shows here in an excellent way what the problem really is all about. 🙂))

[[deleted]]

Hehe... am I good or what? 🙂