开发者

CMS Preventing Bad HTML Insertion by Client?

I'm building a small CMS in PHP for a client and something I've noticed that comes up fairly often is a client will enter a bit of HTML in a field without closing his/her tag. I'm wondering if there is some parsing technique to prevent bad HTML from rendering my whole output page in italics because the user forgot to add a closing </i> tag.

I'm not worried about XSS or malici开发者_StackOverflow社区ous html, just a forgotten tag here and there as it's the client who is managing the content.

Forgive me if this is a duplicate question, I did some searching, but could not find an appropriate answer.

-J


You may want to tidy the HTML input from the user so that the dirty HTML can be fixed. Check out the PHP5 Tidy extension to achieve this.

http://devzone.zend.com/article/761


Why do you not use an IFRAME with the contents the user edited in another page ?

That way only that page is 'at risk', and you can use a scrollable reagon too.

Just a thought ...

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜