1

I worked this period on bbcode and encountered a problem (nested similar codes)

this is the code 01 :

function FFF999_BBcode($content) 
{
    $search = array (
    '/(\[color=)(.*?)(\])(.*?)(\[\/color\])/'
    );
    
    $replace = array (                   
    '<span style="color: $2">$4</span>'
    );
    return preg_replace($search, $replace, $content);
}

this is the input:

[color=red][color=blue]test test test[/color][/color]

this is the result 01 :

<span style="color: red"><a href="page?q=color=blue">color=blue</a>test test test</span><a href="page?q=/color">/color</a><br />

result code 01

=====================================

Then I modified the code to this

this is the code 02 :

function FFF999_BBcode($content) 
{
    $search = array (
    '/(\[color=)(.*?)(\])/',
    '/(\/color\])/',
    );
    
    $replace = array (                   
    '<span style="color: $2">',
    '</span>',
    );
    return preg_replace($search, $replace, $content);
}

this is the result 02:

<span style="color: red"><span style="color: blue">test test test[</span>[</span><br />

result code 02

=====================================

Both codes have implementation problems.

But what is the best of them programmatically to start modifying it and find a complete solution to the result?

3
  • You're still wide open to XSS like this lol echo FFF999_BBcode('[color=red;"><img src=# onerror=javascript:alert(1)><!--]Test[/color]'); - whitelist your colours Commented Jul 3, 2022 at 15:49
  • Thank you for your response.. I have a function to protect and clean the inputs before starting to process them.. My inquiry is based on this point only Commented Jul 3, 2022 at 16:03
  • Does this answer your question? Multidimentional BBCODE Commented Jul 4, 2022 at 5:46

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.