What to strip from a blog post

Discussion in 'Security' started by Silver89, Jul 30, 2010.

0
  1. #1
    If your allowing users to create blogs from subdomains then what code should you make sure is always stripped from posts?

    For example you would always want to remove "<?php" so that php couldn't be run.

    Is it safe to allow all javascript to be used aswel?
     
    Silver89, Jul 30, 2010 IP
  2. phpSiteMinder

    phpSiteMinder Peon

    Messages:
    47
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #2
    No definitely not safe to allow javascript. That would allow cross site scripting attacks. I would also strip out html such as frame and iframe tags. Basically any html that isn't solely used for presentation.
     
    phpSiteMinder, Jul 31, 2010 IP
  3. Silver89

    Silver89 Notable Member

    Messages:
    2,243
    Likes Received:
    72
    Best Answers:
    0
    Trophy Points:
    205
    #3
    I'm using the following at the moment which seems to work okay:

    
	$newText = strip_tags($text, '<p><a><b><strong><i><u><img><strike><sub><sup><ol><ul><li><div><blockquote><object><param><embed><hr><br><table><tbody><tr><td><h1><h2><h3><h4><h5><span>');
    PHP:
     
    Silver89, Aug 4, 2010 IP