php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #38967 strip_tags doesn't remove attributes completely
Submitted: 2006-09-26 22:41 UTC Modified: 2008-02-19 00:44 UTC
From: corinl at gmx dot de Assigned:
Status: Closed Package: Feature/Change Request
PHP Version: 5.1.6 OS: linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: corinl at gmx dot de
New email:
PHP Version: OS:

 

 [2006-09-26 22:41 UTC] corinl at gmx dot de
Description:
------------
when a tag attribute contains a <, it does not get removed properly.

Reproduce code:
---------------
<?
$s = <<<EOT
nothing should be between this - <img src="http://static.flickr.com/105/253610807_10f90540d3.jpg?v=0" alt="" style="max-width:50px;width:expression(this.width>50?50:true);"></img> - and this.
EOT;
echo($s);
echo('<hr>');
echo('original: '.htmlentities($s));
echo('<hr>');
echo('stripped: '.htmlentities(strip_tags($s)));
?>

Expected result:
----------------
stripped: nothing should be between this -  - and this.

Actual result:
--------------
stripped: nothing should be between this - 50?50:true);"> - and this.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-02-19 00:44 UTC] felipe@php.net
This seems be fixed... At least, it doesn't occur in 5.2.6.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Mon Sep 16 19:01:28 2024 UTC