Checking link syntax of user input
I have a site where users can enter comments and descriptions. I allow them to enter links in as well. I use strip_tags
with an exception for links. I also add rel="nofollow"
through a simple string_replace.
The problem is, if users leave off a double quote at the end of their opening tag, it messes up the html. Any suggestions on how to check for or fix incorrect link syntax?
$comment = $_POST开发者_StackOverflow中文版['comment'];
$comment = strip_tags($comment,"<a>");
$comment = str_replace('<a','<a rel="nofollow"',$comment);
$comment = mysql_real_escape_string($comment);
and when outputting
$comment = stripslashes($comment);
echo $comment;
The problem is when users add <a href="www.blah.com>
and forget the last double quote, this messes up the way the comment div displays.
Here's what you have to do:
function fixLink($link) {
$link = str_replace(array('<a', '"', '</a>'), '', $link);
$link = str_replace(
array('=', '>', ' '),
array('="', '">', '" '),
$link);
return '<a rel="nofollow' . $link . '</a>';
}
echo fixLink('<a href="/index.html>asd</a>') . "\n";
echo fixLink('<a class="awesome" href="/index.html>asd</a>') . "\n";
echo fixLink('<a href="/index.html class="awesome">asd</a>') . "\n";
echo fixLink('<a target="_blank" href="/index.html class="awesome">asd</a>') . "\n";
echo fixLink('<a target="_blank" href="/index.html class="awesome>asd</a>') . "\n";
echo fixLink('<a target="_blank" href="/index.html target="_blank" class="awesome">asd</a>') . "\n";
echo fixLink('<a href="/index.html class=awesome">asd</a>') . "\n";
That will output:
<a rel="nofollow" href="/index.html">asd</a>
<a rel="nofollow" class="awesome" href="/index.html">asd</a>
<a rel="nofollow" href="/index.html" class="awesome">asd</a>
<a rel="nofollow" target="_blank" href="/index.html" class="awesome">asd</a>
<a rel="nofollow" target="_blank" href="/index.html" class="awesome">asd</a>
<a rel="nofollow" target="_blank" href="/index.html" target="_blank" class="awesome">asd</a>
<a rel="nofollow" href="/index.html" class="awesome">asd</a>
精彩评论