How can I check if the value of a textarea has HTML in it using PHP?

Question

I am currently using jQuery to check if the textarea has HTML in it: (and I will continue to use this)

   if ($('textarea#newMessage').val().match(/<(\w+)((?:\s+\w+(?:\s*=\s*(?:(?:"[^"]*")|(?:'[^']*')|[^>\s]+))?)*)\s*(\/?)>/)) {
      $('textarea#newMessage').focus();
      $('#error').html('Error: HTML is not aloud. Please remove all of the HTML in your message to continue.')
      .click(function() { $('#newMessage').focus(); })
      .stop(true,true)
      .fadeIn(800)
      .delay(1500)
      .fadeOut(200);
      return false;
   }

But, how can I use PHP to do this same thing? If someone disables JavaScript, they can easily submit the form with HTML in it. Is there a way for PHP to do this also?

See stackoverflow.com/questions/5732758/…

Buddy
– Buddy

2011-08-28 18:55:31 +00:00
Commented Aug 28, 2011 at 18:55 — Buddy
– Buddy, Commented Aug 28, 2011 at 18:55
a simpler expression would be /<.*?>/

Herbert
– Herbert

2011-08-28 22:27:34 +00:00
Commented Aug 28, 2011 at 22:27 — Herbert
– Herbert, Commented Aug 28, 2011 at 22:27

harpax · Accepted Answer · 2011-08-28 18:57:27Z

4

if ($text != strip_tags($text))
    // text contains html

see strip_tags

answered Aug 28, 2011 at 18:57

harpax

6,1265 gold badges38 silver badges49 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Herbert · Accepted Answer · 2011-08-29 04:59:01Z

2

This will catch tags and no text.

$textareaname = (isset($_POST['textareaname']))
                ? $_POST['textareaname']
                : '';

if ($textareaname !== strip_tags($_POST['textareaname']))
{
    // contains tags
}

elseif (trim($textareaname ) === '')
{
    // textarea is empty
}

else
{
    // OK! do something
}

Notes:

If the form is sent without anything in the textarea, $_POST['textareaname'] won't exist and PHP will throw an error when you try to use it.
If someone sends nothing but spaces trim() will catch it.

edited Aug 29, 2011 at 4:59

answered Aug 28, 2011 at 19:45

Herbert

5,7983 gold badges28 silver badges34 bronze badges

4 Comments

Nathan Over a year ago

I kinda actually rather have the error message. I would accept your answer, but I rather have the error message as if they don't have JavaScript enabled, they might be trying to bypass my jQuery checking, which would mean that it should show an error even with the PHP. But thanks so much for telling me about trim()!! :) Also, I might not want to forgo the jQuery method because I am going to be using AJAX to submit the form.

Herbert Over a year ago

@Nathan: In light of your comment, I updated the code to check for tags and empty textareas with nothing but spaces.

Nathan Over a year ago

Thanks so much! :) What does the ? and other stuff do in the variable? Is it part of isset()?

Herbert Over a year ago

a ? b : c is a shortcut for if(a) b else c. For a better explanation see ternary operators in the manual or Reference - What does this symbol mean in PHP?

str · Accepted Answer · 2011-08-28 18:56:44Z

1

Use preg_match() with the regular expression you already got. And by the way: Instead of "aloud" you probably mean "allowed" ;)

answered Aug 28, 2011 at 18:56

str

45.5k18 gold badges117 silver badges134 bronze badges

1 Comment

Nathan Over a year ago

Yep, I meant "allowed" LOL. Thanks.

RiaD · Accepted Answer · 2011-08-28 19:41:35Z

1

First of all, you may use exactly same regexp via preg_match

Besides, you want to restrict HTML to avoid changing anything in your code structure.
So, you may just use htmlspecialchars to print HTML as plain text.
But If you really need check, are they exists, you may just check symbols < and > that can break you markup by preg_match('~[<>]~',..) or just to strpos'es

answered Aug 28, 2011 at 19:41

RiaD

47.8k12 gold badges85 silver badges128 bronze badges

1 Comment

Nathan Over a year ago

Yeah, well the reason I'm restricting HTML is because the textarea is a reply thing, and when you reply it gets added to the database and an email gets send. I don't want extra HTML in the email. (someone could easily add JavaScript to the reply with <script> tags and mess something up)

Kakashi · Accepted Answer · 2011-08-28 23:51:53Z

1

Try this:

if(preg_match("/<[^>]*>/", $_POST['textareaname'])){
   //contains html tags
} else {
   //dosomething...
}

edited Aug 28, 2011 at 23:51

answered Aug 28, 2011 at 18:56

Kakashi

2,20515 silver badges19 bronze badges

7 Comments

Nathan Over a year ago

Will this check if the textarea is empty? (I also needed this too) If so thanks also.

Kakashi Over a year ago

edited.. remove html tags and check if the textarea is empty.

Nathan Over a year ago

Will this remove them or show an error if it has HTML tags in it?

Herbert Over a year ago

For increased usability you could have PHP automatically strip the tags instead of requiring the user to do it. Also: isset($_POST['textareaname']) will check if the textarea is empty. See isset in the manual.

Nathan Over a year ago

@Herbet What if someone puts in some spaces? Will it count as not empty with isset()? I have been trying to figure that out for a while because right now I just use if($value = '') { and that allows the user to just type a space and send it without anything in it.

|

Collectives™ on Stack Overflow

How can I check if the value of a textarea has HTML in it using PHP?

5 Answers 5

Comments

4 Comments

1 Comment

1 Comment

7 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

4 Comments

1 Comment

1 Comment

7 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related