Skip to main content
A
Anonymous
January 18, 2009
Question

Stripping out html from form submissions

  • January 18, 2009
  • 2 replies
  • 339 views
My web developer is using the attached code to strip/disallow html code from form submissions in an effort to prevent someone from posting dangerous scripts or code via a form or blog.

Problem is, I DO want to at least allow people to post url links to external content like youtube videos, their own webstes, images etc.... Basically if it is something hosted AND viewed on a site other than mine I would like to give them the ability to link to it. How could I edit the code to allow links of this nature or is there a better way to do this?

My developer has basically told me there is no other way. It is either disallow it all or open it up. I disagree with this and am looking for a 2nd opinion.
    This topic has been closed for replies.

    2 replies

    D
    Dan_Bracuk
    Inspiring
    January 19, 2009
    If the script comments are accurate, they will not achieve your goal. On the topic of your goal, if a user wanted to post a link to his youtube video page, would you be expecting him to post just the url, or a complete anchor tag?
    D
    Dan_Bracuk
    Inspiring
    January 18, 2009
    url links are not html.

    Regular expressions are not my strength, but it looks like that function is simply replacing sets of angle brackets with empty strings.

    In other words, if your users submit http://somesite.com, that will not be affected by the function. However, if they submit <a href=" http://somesite.com">, it will be transformed to href=" http://somesite.com". In either case, it will be text, not a link.
    A
    Anonymous
    January 19, 2009
    I am going to have them try this UDF that I found. Do you think this will do the trick?
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices