Shoutbox

Actually, I was surprised to find out that the Sony Playstation forums use HTML and no form of bb ( http://boardsus.playstation.com/playstation/ )

quote:

---

Originally posted by KeyStorm
while($code == strip_tags($code, ...)
$code == strip_tags($code, ...);

---

I don't think your code is quite right, but I know what you're talking about. I didn't think anyone would be smart enough to post that though.

Anyways, what about using dodgy attributes in an allowed tag?

<img src="images/smilies/omardodgy.gif" style="position: absolute; top: 10px; left: 10px;">
<img src="images/smilies/wdz.gif" onload="runDodgyScript();">

To effectively stop that, you'd probably need regexps, and then you're getting closer to just using BBcode.

Aw, yeah the second line has an equal too much, and such potentially exploitable attributes should have to be removed, too.

Regex smells like... "let's leave it as it is, kthks".

quote:

---

Originally posted by traxor
use mybb code... for help on that go here:

http://shoutbox.menthix.net/misc.php?action=help&hid=8

---

Nice, about time we got somethign like this for a reference... I like it...

quote:

---

Originally posted by Pr0xY

quote:

---

Originally posted by traxor
use mybb code... for help on that go here:

http://shoutbox.menthix.net/misc.php?action=help&hid=8

---

Nice, about time we got somethign like this for a reference... I like it...

---

thats been there forever

btw WDZ, wheres the runDodgyScript(); comong from, you wont be including it in the sent page source, and Javascript is clientside, so they would only be doing harm to themselves.

and if these forums are coded corectly (which im sure they are ) theres no need to worry. just use KeyStorm's strip_tags functions.

anyway, maybe someone good with using str_replace should code a quick HTML to BBCode, that searches for like <a href='linkage' border='0'> and it ignores the unneeded commands like onClick and border.

if you know what i mean

No html codes
Really irritating if there would be a marque going accross when we are reading something. Someone told the already rite ???
Still no

quote:

---

Originally posted by Ash_
btw WDZ, wheres the runDodgyScript(); comong from

---

It could be a built-in JavaScript function, or you could type as much code as you want right inside there. I've seen some pretty impressive one-line JavaScripts. It could be used to do a cross-site-scripting attack, or steal login cookies, or some other dodgy stuff.

quote:

---

Originally posted by Ash_
and if these forums are coded corectly (which im sure they are)

---

haha... I'm not so sure.

quote:

---

Originally posted by Ash_
anyway, maybe someone good with using str_replace should code a quick HTML to BBCode, that searches for like <a href='linkage' border='0'> and it ignores the unneeded commands like onClick and border.

---

str_replace()? preg_replace() is what should be used. Anyway, I don't think that's necessary, and I haven't even begun to think about the possible limitations and side effects.