forum posting

[bobnew32]

Ok I have heard of the nl2br method of making posts multiline, but what is the deal with preg_replace and the lot. I just don't get it, plus how do all the forum software out there, even custom made ones make a post "safe" (removing all the html java code the person posting could put in there to screw the page up?) Or there an easy way or hard way? I saw today a ASCII post?

Can somone please offer me a solution, im designing my own forum script and this is the only obstacle standing in my at the moment. Thx

[bilalak]

Hi
you can use strip_tags() for html.
For Java Script you can use preg_replace()
Try the help at php.net and user replies

Luck!

[dmorison]

One way to learn how its done is to download one of the open source BBS systems and study the code.

Not a lot to it; just a whole series of string replacement calls, making sure that tags balance (so that people can't enter [b] on its own trying to make the rest of your page go bold), and the usual HTML entity conversion with html_entities() or similar function.

Other things to quash include multiple new lines (especially at the beginning or end of a post), and also very long lines. CSS's word wrap features can help here.

[vincevincevince]

I find unless you have a high load application, do one thing at a time. Start by nullifying the < and > into &lt; and &gt;

$post=str_replace("<","&lt;",$post);
$post=str_replace(">","&gt;",$post);

Now you know they can't be adding any HTML in themselves. Now you will want to support some custom formatting, for example

[b]

[/b]

. For this use a regular expression to auto-balance the tags:

$post=preg_replace("/\[b\](.*)\[\/b\]/","<b>$1</b>",$post);

ie, you put HTML back in again, but only the bits you want.

Remember to take out things you don't want - like more than two newlines:

$post=preg_replace("/\n[^\w]*\n[^\w]*\n/","\n",$post); 

Finally, you want to throw it through nl2br().