PHP允许img和锚点-但排除其他标签

Question

I have a textarea where my users need to be allowed to post links, mail and images.

function autolink($message)
{
    $text = " " . $message;
    $text = preg_replace("#([\n ])([a-z]+?)://([a-z0-9\-\.,\?!%\*_\#:;~\\&$@\/=\+]+)#i", "\\1<a href=\"\\2://\\3\" target=\"_blank\" class=\"link\">\\2://\\3</a>", $text);
    $text = preg_replace("#([\n ])www\.([a-z0-9\-]+)\.([a-z0-9\-.\~]+)((?:/[a-z0-9\-\.,\?!%\*_\#:;~\\&$@\/=\+]*)?)#i", "\\1<a href=\"http://www.\\2.\\3\\4\" target=\"_blank\" class=\"link\">www.\\2.\\3\\4</a>", $text);
    $text = preg_replace("#([\n ])([a-z0-9\-_.]+?)@([\w\-]+\.([\w\-\.]+\.)?[\w]+)#i", "\\1<a href=\"mailto:\\2@\\3\" class=\"link\">\\2@\\3</a>", $text);

    $text = substr($text, 1);
    return($text);
}

This function works like a charm, but if I want to add a line who replaces img src - it wont work anymore.

$text = preg_replace('#<img.+?src="([^"]*)".*?/?>#i', '<a href="$1">$0</a>', $text);

The above works very well, but now it wont replace anchors and mails as links.

I've searched this forum and found a might-work answer, it includes the php function strip_tags();

$allowed = "<img><a>";
$formatted = strip_tags($_POST['usercomment'], $allowed );

What is the most secure (and right) solution to this? I've read about some DOM and that regulair expressions isn't right for this job, but I really need som help with this. Without the line with img tag, my function works very well when a user post a link ( http://example.com ) and this becomes clickable.

Excuse me for my poor english and way of description, this is my first post inhere.

Answer 1

Why not just strip out everything, and make your users use bbcode, I just wrote this function to do something similar.

function html2txt($document){ 
`$search = array('@<script[^>]*?>.*?</script>@si',  // Strip out javascript 
           '@<[\/\!]*?[^<>]*?>@si',            // Strip out HTML tags 
           '@<style[^>]*?>.*?</style>@siU',    // Strip style tags properly 
           '@<![\s\S]*?--[ \t\n\r]*>@',         // Strip multi-line comments including CDATA 
           '@EMBED@siU',
           '@SRC@siU',
           '@allowScriptAccess@siU',
           '@allownetworking@siU',
           '/<.*?>/'
); 
$text = preg_replace($search, '', $document); 
return $text;
}

function display_bbcode($string){
    $search = 
    array(
    '~\[url(?|=[\'"]?+([^]"\']++)[\'"]?+]([^[]++)|](([^[]++)))\[/url]~', // URL
    '/\[b\](.*?)\[\/b\]/ms', // Bold
    '/\[i\](.*?)\[\/i\]/ms', // Italic
    '/\[u\](.*?)\[\/u\]/ms', // Underline
    '/\[img\](.*?)\[\/img\]/ms', //IMG
    '/\[size\="?(.*?)"?\](.*?)\[\/size\]/ms', //Font Size
    '/\[color\="?(.*?)"?\](.*?)\[\/color\]/ms', // Color
    '/\[quote](.*?)\[\/quote\]/ms', //Quote
    '/\[list\=(.*?)\](.*?)\[\/list\]/ms', //List 
    '/\[list\](.*?)\[\/list\]/ms', // Default List
    '/\[\*\]\s?(.*?)\n/ms'
); 
$replace = 
array(
'<a href="$1">$2</a>', // URL
    '<strong>\1</strong>', // Bold
    '<em>\1</em>', // Italic
    '<u>\1</u>', // Underline
    '<img src="\1" alt="\1" height=\'200px\' width=\'200px\'/>', //Image, Auto Re-size
    '<font size="\1%">\2</font>',// Font Size
    '<font color="\1">\2</font>', // Font Color
    '<blockquote>\1</blockquote>', //Qoute 
    '<ol start="\1">\2</ol>', // Some List Style?
    '<li>\1</li>',//Default List Style
    '<li>\1</li>'
    );
    $text = preg_replace($search, $replace, $string);
    return $text;
}

Then just call your functions:

When user posts content: strip_tags(html2txt($input));

When displaying the Content: display_bbcode($output);