I am now using this by the way since the other topic is closed, any comments?
<?php
// adapted from http://www.bioinformatics.org/phplabware/forum/viewtopic.php?id=211 as the documentation for htmlLawd is highly confusing!
// this needs better commenting to explain what it does step by step (so i can understand it properly too) as its a quick fix to get the editors working and secure enough
require_once('htmLawed.php');
// This function is called from the script that needs it
function parse($text)
{
global $db;
$config = array('safe'=>1, 'cdata'=>1, 'comment'=>1, 'deny_attribute'=>'* -href -style', 'elements'=>'a, em, strong, p, hr, br, ul, ol, li, sub, sup, span, div', 'keep_bad'=>0, 'hook_tag' => 'my_css_filter');
$out = htmLawed(stripslashes($text), $config);
$out = $db->quote_smart($out);
return $out;
}
// This function is never directly called, it is called in the parse function above
function my_css_filter($element, $attribute_array=0)
{
// If second argument is not received, it means a closing tag is being handled
if(is_numeric($attribute_array))
{
return "</$element>";
}
if (isset($attribute_array['style']))
{
$css = explode(';', $attribute_array['style']);
$style = array();
foreach ($css as $v)
{
if (($p = strpos($v, ':')) > 1 && $p < strlen($v))
{
$prop_name = trim(substr($v, 0, $p));
$prop_val = trim(substr($v, $p+1));
// this list might need adapting if you want to allow different properties
if ($prop_name == 'color' || $prop_name == 'background-color' || $prop_name == 'font-size' || $prop_name == 'font-family' || $prop_name == 'text-align' || $prop_name == 'text-decoration' || $prop_name == 'padding-left')
{
$style[] = "$prop_name: $prop_val";
}
}
}
if (!empty($style))
{
$attribute_array['style'] = implode('; ', $style);
}
else
{
unset($attribute_array['style']);
}
}
$attributes = '';
foreach ($attribute_array as $k=>$v)
{
$attributes .= " {$k}=\"{$v}\"";
}
static $empty_elements = array('br'=>1, 'hr'=>1);
return "<{$element}{$attributes}". (isset($empty_elements[$element]) ? ' /' : ''). '>';
}
You just call the parse function with your user input text.