RE: what do i need to disable

["Don" <don.rzeszut@xxxxxxxxx>]

> I asked this question awhile ago and never really visited the issue till
> now. The response I got showed me how to disable everything, but I want to
> allow basic html tags.


http://us3.php.net/strip_tags

You can use the optional second parameter to specify tags which should not
be stripped. 

HTH,

Brad


I ended up using strip_tags (thanks Brad)

But to disable other ways of getting javascript to run I also included
this....

$pattern =
array('/(javascript)/','/([jJ(&#106)][aA(&#97)][vV(&#118)][aA(&#97)][sS(&#11
5)][cC(&#99)][rR(&#114)][iI(&#105)][pP(&#112)][tT(&#116)])/','/(\.[jJ(&#106)
][sS(&#115)])/','/([xX][sS(&#115)][sS(&#115)])/','/([xX][mM][lL])/');

$candidateNewBio = preg_replace($pattern, '', $candidateNewBio);

Is this worthwhile or a waste of time, because it seems to really protect
your site, you need have a contingency for every possible attack.... And I
don't even know how some of this stuff is even working with my level of
understanding

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php