[ Closed ] htmLawed results

Thanks for writing. I will look into it.

if i insert 
www.some.link
www.some.link
www.some.link
and ...

forum show error:

Warning! The following errors must be corrected before your message can be posted:

    Too more links in message. Allowed 3 links. Reduce number of links and post it again.

The 'allowed 3 links' message seems to be because of some setting of the forum software that you are using.

Regarding the HTML snippet you put on Pastebin, I tried it with both the current release and the current beta of htmLawed on the htmLawed test pages. I get different outputs than the ones you note.

<object width="560" height="315">¬
<param name="movie" value="//www.youtube.com/v/FL9sJygKzgk?version=3&amp;hl=ru_RU" />¬
<param name="allowFullScreen" value="true" />¬
<param name="allowscriptaccess" value="always" />¬
<embed src="//www.youtube.com/v/FL9sJygKzgk?version=3&amp;hl=ru_RU" type="application/x-shockwave-flash" width="560" height="315" />¬
</object>

htmLawed does remove the 'allowscriptaccess' and 'allowfullscreen' attributes of the 'embed' element, which is expected as those attributes are not in the HTML specs. However, to allow their use, you can use the $spec parameter of htmLawed:

$config = array(...); // htmLawed config.
$spec = 'embed = *, allowscriptaccess, allowfullscreen';
$out = htmLawed($in, $config, $spec)

With your $config values, I still get the expected result as noted in my last post; that is, I do not see an issue.

Regarding 'keep_bad,' it is to declare how htmLawed deals with tags that are filtered out. With 'keep_bad' set to 1, htmLawed will neutralize such tags by converting '<' and '>' characters to entities ('&lt;' and '&gt'). See documentation on keep_bad.

// input; 'param' is an empty element; that is, it should not have the closing tag '</param>'
<param name="allowscriptaccess" value="always"></param>

// output, with keep_bad = 6 (default value, used when not declared)
<param name="allowscriptaccess" value="always" />

// output, with keep_bad = 1
<param name="allowscriptaccess" value="always" />&lt;/param&gt;

It looks like a good feature to have, but I feel the current configurability of the 'keep_bad' config. parameter is sufficient for handling 'bad' tags, and having this additional option is not worth the additional script execution time.

You can also remove the closing tags for these empty elements with plain PHP before passing the input to htmLawed. E.g.:

// remove closing tags for empty elements that shouldn't have them
$in = str_ireplace(array('</br>', '</embed>', '</hr>', '</img>'...), '', $in);
$out = htmLawed($in, $config...);

OK! No Cyrillic.

htmLawed('<p><a href="link">Edit description</a></p>', array('safe' => 1,'keep_bad' => 1,));

<p></p><a href="link">Edit description</a>&lt;/p&gt;