Want to 'sandbox' user form submitted HTML
- by pmmenneg
Hi all. I have a user form with a textarea that allows users to submit html formatted data. The html itself is limited by PHP strip_tags, but of course that does no completion checking etc.
My basic problem is that should a user leave a tag unclosed, such as the tag, then all the content following that, including page content that follows that is 'outside' the user content display area, could now be malformed.
Checking for proper tag completion is one solution I will look at, but ideally I'd like to firewall the user htmlified content away from the rest of the site somehow.
Any suggestions on the best approach?
Thanks!