Guestbook Question *resolved*
I've created a guestbook (finally!), and I just noticed that I can even put in HTML tags in there.
Since I'm displaying the guestbook using tables and tds and trs, this means that a user can screw up the whole page by putting in a single </tr> or a </td> in there.
What can I do to prevent such a thing from happening?
Re: Guestbook Question *resolved*
Quote:
Originally posted by mendhak
I've created a guestbook (finally!), and I just noticed that I can even put in HTML tags in there.
Since I'm displaying the guestbook using tables and tds and trs, this means that a user can screw up the whole page by putting in a single </tr> or a </td> in there.
What can I do to prevent such a thing from happening?
Quote:
Originally posted by da_silvy
or it might be the function
htmlspecialchars($text);
There's also the strip_tags() function which removes HTML and PHP tags from a string, unlinke htmlspecialchars() which just makes them viewable.
But the cool thing about strip_tags() is that it lets you specify allowable tags which wont be stripped. So, say you want the user to be able to use <b>, <i>, and <u> (although, I believe <u> is deprecated), then you can do this:
Code:
strip_tags($text, "<b><i><u>");
Just thought I'd show you this option.
Re: Re: Guestbook Question *resolved*
Quote:
Originally posted by The Hobo
There's also the strip_tags() function which removes HTML and PHP tags from a string, unlinke htmlspecialchars() which just makes them viewable.
But the cool thing about strip_tags() is that it lets you specify allowable tags which wont be stripped. So, say you want the user to be able to use <b>, <i>, and <u> (although, I believe <u> is deprecated), then you can do this:
Code:
strip_tags($text, "<b><i><u>");
Just thought I'd show you this option.
Very useful, thanks man! I don't think the style thing will be a really big problem, so I might as well go ahead with this. (I wanted to allow for <b><i> and <u> tags to work, the rest to be disabled).
Well, I guess open source isn't as bad as I thought it was :D