Using preg replace

Closing my security loop hole

[ntbgl]

My PHP script reads $text, finds instances of special code, and then modifies the $text to implament the purpose of the special code.

In this case, my special code looks like this:

[[YouTube:DPBqEdjYw-E]] or
[[YouTube:DPBqEdjYw-E¦Description of the video]]

This is what my script looks like, and it works:

$youtube="<div class=\"thumb tright\"><div class=\"thumbinner\" style=\"width:425px\">"
."<object width=\"425\" height=\"350\">"
."<param name=\"movie\" value=\"http://www.youtube.com/v/\\1\"></param>"
."<param name=\"wmode\" value=\"transparent\"></param>"
."<embed src=\"http://www.youtube.com/v/\\1\" type=\"application/x-shockwave-flash\" wmode=\"transparent\" width=\"425\" height=\"350\">"
."</embed></object>"
."<div class=\"thumbcaption\">\\2</div></div></div>"
."[[Category:YouTube video]]";
$text=preg_replace("/\[\[YouTube:([^\¦]*)\¦?(.*)\]\]/",$youtube,$text);

But I realized that its vulnerable, and I need to strip tags if used in my special code, but the way I have to pull up preg_replace, (for some reason it just seems backwards to me), I don't know how to strip tags, or even only work if the first part of the special code matches a proper YouTube video pattern of [a-zA-Z0-9_-]{11}

Any help is greatly appreciated.

[edited by: eelixduppy at 2:08 am (utc) on May 22, 2009]
[edit reason] disabled smileys [/edit]

[eeek]

You might find some examples in this module:

[phorum.org...]