Dealing with user input HTML

Question

I have a simple textarea where users can input a description for their product on my dummy system. I'm only allowing   and  tags, without any attributes using the following code:

$description = strip_tags($_POST['description'], "<b><u><i>");
$description = preg_replace("/<([a-z][a-z0-9]*)[^>]*?(\/?)>/i",'<$1$2>', $description);

My problem is when a tag is left without it's closing part, for example:

<b>This is a <i>Test

The  and  tags will apply to everything that comes after this part. Is there any reliable way to automatically close the tags?

What I want is for the tag to be closed on the end of the user input, but only if it was left open.

How would you know where to automatically close the tag? What exactly is the desired behavior? — nullability, Apr 02 '18 at 18:28
@nullability Edited the question with the desired behavior. I want it to be closed right after the user input ends, but only if he left it unclosed. — Antonio Neto, Apr 02 '18 at 18:31
Also, your regex looks slightly strange. What were you trying to do? — Evgeny Ruban, Apr 02 '18 at 18:38
@EugeneR I got the regex from here https://stackoverflow.com/questions/3026096/remove-all-attributes-from-an-html-tag?utm_medium=organic&utm_source=google_rich_qa&utm_campaign=google_rich_qa — Antonio Neto, Apr 02 '18 at 18:44

score 0 · Answer 1 · answered Apr 02 '18 at 18:44

This code would require some additional finetuning but it will help you to get the gist of the idea.

$tags = ['b', 'i', 'u'];

foreach($tags as $t){
  if($a = substr_count($message, "<$t>") != $b = substr_count($message, "</$t>"){
    if($a > $b){
      $message .= str_repeat("<$t>", $a - $b);
    } else {
      // more closing tags then opening.
      $message = strrev($message);
      str_replace("<$t/>", '', $message, $b - $a);
      $message = strrev($message);
    }
  }
}

$message holds the entire text area text. It counts all the tags and if there is an inconsistency it will append at the end of the string.

score 0 · Accepted Answer · answered Apr 02 '18 at 20:06

0

I ended up solving the problem by using Tidy. Here's the code:

$tidy = new Tidy();
$description = $tidy->repairString($description, array(
    'output-xml' => true,
    'input-xml' => true,
    'vertical-space' => false
));

answered Apr 02 '18 at 20:06

Antonio Neto

176
10

Dealing with user input HTML

2 Answers2