PHP convert string to htmlentities

Question

How can I convert the code inside the <code> and <pre> tags to html entities ?

<code class="php"> <div> a div.. </div> </code>

<pre class="php">
<div> a div.. </div>
</pre>

<div> this should be ignored </div>

Depends on the context. Where does the code reside? Inside a string? — Lightness Races in Orbit
– Lightness Races in Orbit, Commented Apr 2, 2011 at 23:04
@Alexandra this is tough, because you'd need to parse the structure first to tell apart the parts you need to entity from those you don't. Why is it mixed that way in the first place? Can you influence how this is generated? — Pekka
– Pekka, Commented Apr 2, 2011 at 23:07
i can't.. this is the output when a visitor posts a comment and I want to be able for them to post html too — Alex
– Alex, Commented Apr 2, 2011 at 23:09
@Alexandra You can't just let visitors post HTML to your site — this enables XSS attacks and allows bots to post really nasty spam that is invisible to regular visitors, but visible to search engine bots. — Kornel
– Kornel, Commented Apr 2, 2011 at 23:16

Lightness Races in Orbit · Accepted Answer · 2011-04-03 22:08:15Z

2

OK, I've been playing with this for a while. The result may not be the best or most direct solution (and, frankly, I disagree with your approach entirely if arbitrary users are going to be submitting the input), but it appears to "work". And, most importantly, it doesn't use regexes for parsing XML. :)

Faking the input

<?php

$str = <<<EOF
<code class="php"> <div> a div.. </div> </code>

<pre class="php">
<div> a div.. </div>
</pre>

<div> this should be ignored </div>
EOF;

?>

Code

<?php

function recurse(&$doc, &$parent) {
   if (!$parent->hasChildNodes())
      return;

   foreach ($parent->childNodes as $elm) {

      if ($elm->nodeName == "code" || $elm->nodeName == "pre") {
         $content = '';
         while ($elm->hasChildNodes()) { // `for` breaks the `removeChild`
             $child = $elm->childNodes->item(0);
             $content .= $doc->saveXML($child);
             $elm->removeChild($child);
         }
         $elm->appendChild($doc->createTextNode($content));
      }
      else {
         recurse($doc, $elm);
      }
   }
}

// Load in the DOM (remembering that XML requires one root node)
$doc = new DOMDocument();
$doc->loadXML("<document>" . $str . "</document>");

// Iterate the DOM, finding <code /> and <pre /> tags:
recurse($doc, $doc->documentElement);

// Output the result
foreach ($doc->childNodes->item(0)->childNodes as $node) {
   echo $doc->saveXML($node);
}

?>

Output

<code class="php"> &lt;div&gt; a div.. &lt;/div&gt; </code>

<pre class="php">
&lt;div&gt; a div.. &lt;/div&gt;
</pre>

<div> this should be ignored </div>

Proof

You can see it working here.

Note that it doesn't explicitly call htmlspecialchars; the DOMDocument object handles the escaping itself.

I hope that this helps. :)

edited Apr 3, 2011 at 22:08

answered Apr 3, 2011 at 0:01

Lightness Races in Orbit

387k77 gold badges670 silver badges1.1k bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Dejan Marjanović Over a year ago

My code also appears to work... Yours breaks easily as mine. PS I wasted 16min less than you have.

Lightness Races in Orbit Over a year ago

@webarto: Thanks for your unconstructive comment. Could you provide an example of input that breaks my code, so that I can fix it? PS it's not a waste if you're on Stack Overflow to help people. And it's 12 minutes.

Lightness Races in Orbit Over a year ago

I have just noticed that HTML appears to be escaped twice. This is now fixed.

Dejan Marjanović Over a year ago

It is not nonconstructive (codepad.org/FulWwCbC), it brings fatal error if you add just one closing tag that is not opened, anyway, you code is fancy, but in real situations it is worthless, just as mine.

Lightness Races in Orbit Over a year ago

@webarto: Of course, valid XML is required. That is a pre-requisite that I suppose I should mention in the answer.

Jess · Accepted Answer · 2011-04-02 23:33:33Z

2

You can use jquery. This will encode anything inside any tags with a class code.

$(".code").each(
    function () {
        $(this).text($(this).html()).html();
    }
);

The fiddle: http://jsfiddle.net/mazzzzz/qnbLL/

answered Apr 2, 2011 at 23:33

Jess

8,7306 gold badges51 silver badges68 bronze badges

6 Comments

Christian Over a year ago

+1 I'd recommend this approach as long as the result HTML is not insecure.

Lightness Races in Orbit Over a year ago

This question is about PHP, not Javascript.

Alex Over a year ago

but how can you get hacked if the code is escaped? stackoverflow does the same thing....

Lightness Races in Orbit Over a year ago

@Alexandra: No, it doesn't. Stack Overflow accepts a strict subset of HTML. You reject a strict subset of HTML.

Alex Over a year ago

@Tomalak but i only do that to the stuff inside CODE. on the rest of the comment I'm stripping tags just like SO

|

Dejan Marjanović · Accepted Answer · 2011-04-02 23:49:30Z

2

PHP

if(preg_match_all('#\<(code|pre) class\=\"php\"\>(.*?)\</(code|pre)\>#is', $html, $code)){
    unset($code[0]);
    foreach($code as $array){
        foreach($array as $value){
            $html = str_replace($value, htmlentities($value, ENT_QUOTES), $html);
        }
    }
}

HTML

<code class="php"> &lt;div&gt; a div.. &lt;/div&gt; </code>

<pre class="php">
&lt;div&gt; a div.. &lt;/div&gt;
</pre>

<div> this should be ignored </div>

Have you ever heard of BB code? http://en.wikipedia.org/wiki/BBCode

answered Apr 2, 2011 at 23:49

Dejan Marjanović

19.4k7 gold badges54 silver badges67 bronze badges

10 Comments

Lightness Races in Orbit Over a year ago

This isn't very flexible. You require the tags to have a very strict text layout.

Dejan Marjanović Over a year ago

I don't understand, It breaks just as easily as yours, unstrict layout is just an hacking attempt.

Lightness Races in Orbit Over a year ago

@webarto: No, it breaks more easily. Mine requires valid XML; yours requires an exact text match. The user could not write more spaces inside the tag (which is otherwise valid), or add more parameters in the tag (which is also otherwise valid). Yours also matches <code>...</pre>.

Dejan Marjanović Over a year ago

By exact match you mean <code class="php"></code>? Yes. But it should be strict. Can I insert inline CSS or JS in your code or pre tag? (which doesn't make sense anyway because you can use HTML outside in this case). Yes it does match <code>...</pre>. But valid XML is pre-requisite :)

Lightness Races in Orbit Over a year ago

@webarto: <code class="php"><pre class="php">A</pre>B</code> is valid XML, but your code would (I believe) fail to escape B in it.

|

Community · Accepted Answer · 2017-05-23 12:19:54Z

1

This is related somewhat, you do not have to use Geshi, but I wrote a bit of code here Advice for implementing simple regex (for bbcode/geshi parsing) that would help you with the problem.

It can be tweaked to not use GeSHi, just would take a bit of tinkering. Hope it helps ya.

edited May 23, 2017 at 12:19

CommunityBot

11 silver badge

answered Apr 2, 2011 at 23:08

Jim

18.9k5 gold badges51 silver badges66 bronze badges

Collectives™ on Stack Overflow

PHP convert string to htmlentities

4 Answers 4

5 Comments

6 Comments

10 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

5 Comments

6 Comments

10 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related