Comment Tags

[webmigit]

It occurred to me while writing my CMS the other day that one tag I definitely had to filter out was both sides of the comment tag.. [!-- and --].

You see, you can easily destroy a guestbook or forum or anything that allows you to enter html but just placing the beginning of a comment tag in one spot and then in another post a while later, post the finish..

Also.. I'd suggest censoring.. TABLE, IFRAME, IMG, ILAYER, SPAN, TD, TR, and their closing counterparts... A good webmaster good take over a page that way.. They can close out all of your tags and start their own tags and have their own site going, obviously not good.

Need help in censoring these tags?

// Assuming your variable is called myvar.

<CFLOOP list=&quot;[!--,--]&quot; index=&quot;badTag&quot;>
 <CFSET myvar=ReplaceNoCase(myvar,&quot;#badTag#&quot;,&quot;&quot;,&quot;ALL&quot;)>
</CFLOOP>

// You'll know that I'm using square brackets rather than
// the standard html brackets.. That is just
// for demonstration, all you need to do in your code is
// change to the proper bracket.

Thanks,
Tony Hicks [ Founder of <A href=&quot;

http://www.bibleclicks.com&quot;>Bibleclicks.com</A>,

online bible. ]

 

[CFDude]

Tony,
Good points. May I suggest another approach? Since any html tag starts with < and ends with > You can take simply just look for those. With a good regular expression (which I am not very good at you can probably strip the everything between the tags as well.

If you want the user to able to enter certain tags, have them enter an alternate opening and closing bracket and make sure that it is in your allowed list of html tags.

Like here on the forum, if I want to make something bold, I use the brackets [ and ] instead of < and >