quote:
Originally posted by KeyStorm
while($code == strip_tags($code, ...)
$code == strip_tags($code, ...);
I don't think your code is quite right, but I know what you're talking about. I didn't think anyone would be smart enough to post that though.
Anyways, what about using dodgy attributes in an allowed tag?
<img src="images/smilies/omardodgy.gif" style="position: absolute; top: 10px; left: 10px;">
<img src="images/smilies/wdz.gif" onload="runDodgyScript();">
To effectively stop that, you'd probably need regexps, and then you're getting closer to just using BBcode.
/ 
