NYCPHP Meetup

[Chris Snyder]

strip_attributes() now loops back over the html, checking for new exploits created by the replacements. If any are found it decides the post is malicious and strips all HTML tags.

Same thing with the src='javascript: checks in safe_html().

http://chxo.com/scripts/safe_html-test.php


Horray, I can let people post HTML to my sites again! Unless you find another hole in this, James...