Re: strip_tags bug or intended behavior?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 28/02/2024 20:04, Alan Nelson wrote:
Passing the below example into strip_tags fails because "n<a.length" in the _javascript_ is interpreted as an opening tag. All content after "<a.length" is removed.

Does this seem like a bug or intended behavior? On one hand it seems like a bug because this is valid HTML, but on the other hand strip_tags is not documented as supporting _javascript_ or intended for it.

A little of both. strip_tags is a naive implementation. It looks like it's assuming the <a is the start of a link tag here.

strip_tags doesn't actually try to parse the content using full HTML rules, as per the notes on the manual page: https://www.php.net/strip_tags#refsect1-function.strip-tags-notes

This is one of the reasons it's generally advised to avoid strip_tags.

To correctly handle HTML content you should use the DOM extension (or another HTML parser).

There's a possibility someone may look at this if you file an issue on PHP's GitHub tracker but it's equally possible it may just get closed with a "won't fix" due to strip_tags nature. https://github.com/php/php-src/issues

Personally I would file a separate issue on the Laravel project. While it's documented that assertSeeText relies on strip_tags, that's probably not really a good idea in my opinion: https://laravel.com/docs/10.x/http-tests#assert-see-text

This issue can be worked around by putting spaces around the < in the JS code: https://3v4l.org/VZ6t6


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux