PHP：允许用户发布带有特定标签的帖子
我网站上的用户可以发布新闻。但现在，就 HTML 而言，这都是荣誉系统。
function postNewsItem($subject, $body, $userid){
$time = time();
$subject = mysql_real_escape_string($subject);
$body = mysql_real_escape_string($body);
$q = "INSERT INTO news (subject, body, userid) VALUES ('$subject', '$body', '$userid')";
$result = mysql_query($q, $this->connection);
return 1;
}
我希望用户能够链接到图像、构建表格、将单词加粗等等，但我不希望他们能够链接到恶意脚本之类的。我知道有一些方法可以从用户输入中转义 HTML，但是有没有办法在允许某些标签的同时做到这一点？
Users on my site can post news items. But right now, it's all honor system as far as HTML goes.
function postNewsItem($subject, $body, $userid){
$time = time();
$subject = mysql_real_escape_string($subject);
$body = mysql_real_escape_string($body);
$q = "INSERT INTO news (subject, body, userid) VALUES ('$subject', '$body', '$userid')";
$result = mysql_query($q, $this->connection);
return 1;
}
I want users to be able to link to images, build tables, bold their words, etc etc, but I don't want them to be able to link to malicious scripts and what-not. I know there are ways to escape HTML from user input, but is there a way to do that while allowing certain tags?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
使用HTML PUrifier。它允许您基本上创建允许标签的白名单，并过滤掉其他任何内容。
Use HTML PUrifier. It allows you to basically create a whitelist of allows tags and it filters out anything else out.
您可以使用 strip_tags 并允许某些标签
www.php.net/strip_tags
当然，您需要清理一些属性
you may use strip_tags and allow certain tags
www.php.net/strip_tags
of course you will need sanitize some attributes