How Do I use htmlspecialchars but allow only specific HTML code to pass through without getting converted?

Question

Here is the line of code I have which works great:

$content = htmlspecialchars($_POST['content'], ENT_QUOTES);

But what I would like to do is allow only certain types of HTML code to pass through without getting converted. Here is the list of HTML code that I would like to have pass:

<pre> </pre>
<b> </b>
<em> </em>
<u> </u>
<ul> </ul>
<li> </li>
<ol> </ol>

And as I go, I would like to also be able to add in more HTML later as I think of it. Could someone help me modify the code above so that the specified list of HTML codes above can pass through without getting converted?

Htmlspecialchars doesn't look at html, it looks at characters `<`, `>`, etc and escapes them. So you cannot do it with htmlspecialchars... maybe [htmlpurifier](http://htmlpurifier.org/)? — Esailija, Oct 10 '12 at 12:54
You cannot. But you could convert constrained whitelisted tags back afterwards, `<em>` to `` for example. — mario, Oct 10 '12 at 12:55

Ja͢ck · Answer 1 · 2012-10-10T13:04:15.940

14

I suppose you could do it after the fact:

// $str is the result of htmlspecialchars()
preg_replace('#&lt;(/?(?:pre|b|em|u|ul|li|ol))&gt;#', '<\1>', $str);

It allows the encoded version of <xx> and </xx> where xx is in a controlled set of allowed tags.

edited Oct 10 '12 at 13:04

answered Oct 10 '12 at 12:57

Ja͢ck

170,779
38
263
309

If you also want to allow things like ``, `` or `` you just need to change the pattern string to `'#<(/?(?:pre|b|em|u|ul|li|ol)(?:.*?)?)>#'` – Adam Mar 08 '18 at 12:57
@Adam What if you wanted the href to contain a certain string so not any site could be linked? – TheWelshManc Apr 03 '18 at 21:15
@TheWelshManc for that kind of control it would be advisable to use a proper html processor – Ja͢ck Apr 04 '18 at 07:51
It’s okay I managed to get it to work, I checked to see if it had a very specific string in the url and only then would it allow the href – TheWelshManc Apr 04 '18 at 18:30
@TheWelshManc You have to be careful with that, say you are looking for `example.com` whats to stop someone from putting this in `google.com?example.com`. it would still link to google.com but depending on how you are looking for example.com would probably still pass. the only way to do it is to make sure the URL starts with `https://example.com` – mike16889 Oct 16 '18 at 00:46

score 6 · Answer 2 · answered Oct 10 '12 at 12:59

6

Or you can go with old style:

$content = htmlspecialchars($_POST['content'], ENT_QUOTES);

$turned = array( '&lt;pre&gt;', '&lt;/pre&gt;', '&lt;b&gt;', '&lt;/b&gt;', '&lt;em&gt;', '&lt;/em&gt;', '&lt;u&gt;', '&lt;/u&gt;', '&lt;ul&gt;', '&lt;/ul&gt;', '&lt;li&gt;', '&lt;/li&gt;', '&lt;ol&gt;', '&lt;/ol&gt;' );
$turn_back = array( '<pre>', '</pre>', '<b>', '</b>', '<em>', '</em>', '<u>', '</u>', '<ul>', '</ul>', '<li>', '</li>', '<ol>', '</ol>' );

$content = str_replace( $turned, $turn_back, $content );

answered Oct 10 '12 at 12:59

Peon

7,902
7
59
100

2

I think this (for a small amount of tags and content) could be actually much more faster :) – jave.web Feb 17 '14 at 09:00
@jave.web Very much agreed! – Oct 08 '22 at 15:55

score 2 · Answer 3 · answered Feb 13 '15 at 17:24

I improved the way Jack attacks this issue. I added support for <br>, <br/> and anchor tags. The code will replace fist href="..." to allow only this attribute to be used.

$str = preg_replace(
    array('#href=&quot;(.*)&quot;#', '#&lt;(/?(?:pre|a|b|br|em|u|ul|li|ol)(\shref=".*")?/?)&gt;#' ), 
    array( 'href="\1"', '<\1>' ), 
    $str
);

score 1 · Answer 4 · answered Dec 17 '19 at 15:18

I made this function to sanitize all HTML special characters except for the HTML tags specified.

It first uses htmlspecialchars() to make the string safe, then it reverts the tags I want to be untouched.

The function supports attribute filtering as an option, however be careful to disable it if you care about possible XSS attacks.

I know regex is not efficient but for moderate string lengths it should be fine. You can check the regex I used here https://regex101.com/r/U6GQse/8

public function sanitizeHtml($string, $safeHtmlTags = array('b','i','u','br'), $filterAttributes = true)
{
    $string = htmlspecialchars($string);

    if ($filterAttributes) {
        $replace = "<$1$2$4>";
    } else {
        $replace = "<$1$2$3$4>";
    }
    $string = preg_replace("/&lt;\s*(\/?\s*)(".implode("|", $safeHtmlTags).")(\s?|\s+[\s\S]*?)(\/)?\s*&gt;/", $replace, $string);

    return $string;
}

// Example usage to answer the OP question
$str = "MY HTML CONTENT"
echo sanitizeHtml($str, array('pre','b','em','u','ul','li','ol'));

score 0 · Answer 5 · edited Dec 11 '19 at 10:58

I liked Elwin's solution, but you probably want to:

Prevent Javascript: URL's in the href - or more likely: allow only http(s).
Make the regex globs non-greedy in case there are multiple <a href>'s in the content.

Here is the updated version:

$str = preg_replace(
    array('#href=&quot;(https?://.*?)&quot;#', '#&lt;(/?(?:pre|a|b|br|em|u|ul|li|ol)(\shref=".*?")?/?)&gt;#' ), 
    array( 'href="\1"', '<\1>' ), 
    $str
);

score -3 · Answer 6 · answered Oct 10 '12 at 13:02

-3

You could use strip_tags

$exceptionString = '<pre>,</pre>,<b>,</b>,<em>,</em>,<u>,</u>,<ul>,</ul>,<li>,</li>,<ol>,</ol>';

$content = strip_tags($_POST['content'],$exceptionString );

answered Oct 10 '12 at 13:02

jnoel10

295
2
4
14

That's not exactly what OP is asking for. – Peon Oct 10 '12 at 13:03

How Do I use htmlspecialchars but allow only specific HTML code to pass through without getting converted?

6 Answers6

Linked