function _filter_xss_split
7.x common.inc | _filter_xss_split($m, $store = FALSE) |
6.x filter.module | _filter_xss_split($m, $store = FALSE) |
Processes an HTML tag.
Parameters
@m: An array with various meaning depending on the value of $store. If $store is TRUE then the array contains the allowed tags. If $store is FALSE then the array has one element, the HTML tag to process.
$store: Whether to store $m.
Return value
If the element isn't allowed, an empty string. Otherwise, the cleaned up version of the HTML element.
Related topics
1 call to _filter_xss_split()
- filter_xss in drupal-6.x/
modules/ filter/ filter.module - Filters an HTML string to prevent cross-site-scripting (XSS) vulnerabilities.
1 string reference to '_filter_xss_split'
- filter_xss in drupal-6.x/
modules/ filter/ filter.module - Filters an HTML string to prevent cross-site-scripting (XSS) vulnerabilities.
File
- drupal-6.x/
modules/ filter/ filter.module, line 1040 - Framework for handling filtering of content.
Code
function _filter_xss_split($m, $store = FALSE) {
static $allowed_html;
if ($store) {
$allowed_html = array_flip($m);
return;
}
$string = $m[1];
if (substr($string, 0, 1) != '<') {
// We matched a lone ">" character
return '>';
}
else if (strlen($string) == 1) {
// We matched a lone "<" character
return '<';
}
if (!preg_match('%^(?:<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?|(<!--.*?-->))$%', $string, $matches)) {
// Seriously malformed
return '';
}
$slash = trim($matches[1]);
$elem = &$matches[2];
$attrlist = &$matches[3];
$comment = &$matches[4];
if ($comment) {
$elem = '!--';
}
if (!isset($allowed_html[strtolower($elem)])) {
// Disallowed HTML element
return '';
}
if ($comment) {
return $comment;
}
if ($slash != '') {
return "</$elem>";
}
// Is there a closing XHTML slash at the end of the attributes?
// In PHP 5.1.0+ we could count the changes, currently we need a separate match
$xhtml_slash = preg_match('%\s?/\s*$%', $attrlist) ? ' /' : '';
$attrlist = preg_replace('%(\s?)/\s*$%', '\1', $attrlist);
// Clean up attributes
$attr2 = implode(' ', _filter_xss_attributes($attrlist));
$attr2 = preg_replace('/[<>]/', '', $attr2);
$attr2 = strlen($attr2) ? ' ' . $attr2 : '';
return "<$elem$attr2$xhtml_slash>";
}