Pastable version of HTML Filter

<pre class='prettyprint' language='php'>#!/usr/bin/php
&lt;?php
/**
 * @author Cameron Zemek &lt;cameronz@bundaberg.qld.gov.au&gt;
 */

/**
 * Callback handler for HtmlParser
 */
interface HtmlParserHandler {
    /**
     * Callback for open tag
     *
     * @param $tagName string Tag name
     * @param $attributes array Attributes as an associative array of name =&gt; value
     */
    public function openTag($tagName, $attributes);

/**
     * Callback for close tag
     *
     * @param $tagName string Tag name
     */
    public function closeTag($tagName);

/**
     * Callback for comment tags
     *
     * @param $comment string Comment
     */
    public function comment($comment);

/**
     * Callback for text
     *
     * @param $text string Escaped text
     */    
    public function text($text);
}

/**
 * Handles HTML special characters (ie. &lt; &amp; &gt; &quot;) thereby making it easier
 * for the filter to remove XSS attacks.
 */
class HtmlParser {
    /**
     * Parse HTML snippet
     *
     * @param $html string HTML snippet
     * @param $handler HtmlParserHandler Callback handler
     */
    public function parse($html, HtmlParserHandler $handler) {
        $this-&gt;input = $html;        
        $this-&gt;pos = 0;
        $this-&gt;len = strlen($html);
        $this-&gt;handler = $handler;

$text = '';
        while ($this-&gt;pos &lt; $this-&gt;len) {
            $char = $this-&gt;look();
            if ($char === '&lt;') {
                if ($this-&gt;lookMatches('&lt;!')) {
                    // Handle HTML comment
                    $this-&gt;commentBlock();
                } else {
                    // Process tag
                    $this-&gt;fireText($text);
                    $text = '';
                    $this-&gt;tag();
                }
            } else {
                $text .= $this-&gt;char();
            }
        }
        if ($text !== '') {
            $this-&gt;fireText($text);
        }
    }

protected function fireOpenTag($tagName, $attributes) {
        $this-&gt;handler-&gt;openTag($tagName, $attributes);
    }

protected function fireCloseTag($tagName) {
        $this-&gt;handler-&gt;closeTag($tagName);
    }

protected function fireComment($comment) {
        $this-&gt;handler-&gt;comment($comment);
    }

protected function fireText($text) {
        if (strlen($text) == '') {
            return;
        }
        $this-&gt;handler-&gt;text($text);
    }

/**
     * Parse HTML comment block
     */
    private function commentBlock() {
        $comment = '';
        $this-&gt;matches('&lt;!');
        while ($this-&gt;look() !== '&gt;' &amp;&amp; $this-&gt;pos &lt; $this-&gt;len) {
            if ($this-&gt;lookMatches('--')) {
                $comment .= $this-&gt;comment();
            } else {
                $this-&gt;matchAny(); // Ignore characters outside comment
            }
        }
        $this-&gt;match('&gt;');
        $this-&gt;fireComment($comment);
    }

/**
     * Parse HTML comment
     */
    private function comment() {
        $comment = '';
        $this-&gt;matches('--');
        while (!$this-&gt;lookMatches('--') &amp;&amp; $this-&gt;pos &lt; $this-&gt;len) {
            // Convert characters to stop comment hacks &lt;!------&gt;&lt;script&gt;alert('xss')&lt;/script&gt;--&gt;
            $comment .= htmlspecialchars($this-&gt;matchAny());
        }
        $this-&gt;matches('--');
        return $comment;
    }

/**
     * Parse HTML tag
     */
    private function tag() {
        $output = $this-&gt;match('&lt;');

// Check if close tag
        $closeTag = false;
        if ($this-&gt;look() === '/') {
            $closeTag = true;
            $output .= $this-&gt;match('/');
        }

$tagName = strtolower($this-&gt;matchWord());

// If not valid tag, escape output
        if (strlen($tagName) === 0) {
            $this-&gt;fireText(htmlspecialchars($output));
            return;
        }

if ($closeTag) {
            $this-&gt;match('&gt;');
            $this-&gt;fireCloseTag($tagName);
            return;
        }

$this-&gt;matchWhitespace();
        $attributes = array();
        while ($this-&gt;look() !== '&gt;' &amp;&amp; $this-&gt;pos &lt; $this-&gt;len) {
            $attribute = $this-&gt;attribute();

// Invalid attribute, finish tag
            if (strlen($attribute) === 0) {
                break;
            }

list($attributeName, $attributeValue) = $attribute;
            $attributes[$attributeName] = $attributeValue;
            $this-&gt;matchWhitespace();
        }

if ($this-&gt;look() === '&gt;') {
            $this-&gt;match('&gt;');
        }
        $this-&gt;fireOpenTag($tagName, $attributes);
    }

/**
     * Parse attribute
     */
    private function attribute() {
        $attributeName = strtolower($this-&gt;matchWord());
        if (strlen($attributeName) === 0) {
            return '';
        }
        $this-&gt;matchWhitespace();
        if ($this-&gt;look() === '=') {
            $this-&gt;match('=');
            $this-&gt;matchWhitespace();
            $attributeValue = $this-&gt;attributeValue();
        } else {
            $attributeValue = null;
        }
        return array($attributeName, $attributeValue);
    }

/**
     * Parse attribute value
     */
    private function attributeValue() {
        if ($this-&gt;look() === '&quot;' || $this-&gt;look() === &quot;'&quot;) {
            $quoteChar = $this-&gt;look();
            $this-&gt;match($quoteChar);
            $attributeValue = $this-&gt;matchUntil($quoteChar);
            $this-&gt;match($quoteChar);
        } else {
            $attributeValue = '';
            while (!ctype_space($this-&gt;look()) &amp;&amp; $this-&gt;look() != '&gt;' &amp;&amp; $this-&gt;pos &lt; $this-&gt;len) {
                $attributeValue .= $this-&gt;char();
            }
        }
        if (strlen($attributeValue) === 0) {
            return null;
        }
        return $attributeValue;
    }

/**
     * Match character, handling special characters and character entities
     */
    private function char() {
        if ($this-&gt;look() === '&amp;') {
            return $this-&gt;entity();
        } else {
            return htmlspecialchars($this-&gt;matchAny());
        }
    }

/**
     * Parse HTML entity
     */
    private function entity() {        
        if ($this-&gt;lookMatches('&amp;#x')) {
            return $this-&gt;entityHex();
        } elseif ($this-&gt;lookMatches('&amp;#')) {
            return $this-&gt;entityNumber();
        } else {
            return $this-&gt;entityName();
        }
    }

/**
     * Parse HTML entity name
     */
    private function entityName() {
        $entity = $this-&gt;match('&amp;') . $this-&gt;matchWord();
        if (strlen($entity) === 1) {
            // Invalid entity, escape &amp;
            return htmlspecialchars($entity);
        }
        if ($this-&gt;look() === ';') {
            $entity .= $this-&gt;match(';');
        } else {
            $entity .= ';';
        }
        return $entity;
    }

/**
     * Parse HTML entity in number format. Eg. &amp;#169;
     */
    private function entityNumber() {
        $entity = $this-&gt;matches('&amp;#');
        $entity .= $this-&gt;matchNumber();
        $len = strlen($entity);
        if ($len &lt;= 2 || $len &gt; 6) {
            // Invalid entity, escape &amp;
            return htmlspecialchars($entity);
        }
        if ($this-&gt;look() === ';') {
            $entity .= $this-&gt;match(';');
        } else {
            $entity .= ';';
        }
        return $entity;        
    }

/**
     * Parse HTML entity in hex format. Eg. &amp;#x6A;
     */
    private function entityHex() {
        $entity = $this-&gt;matches('&amp;#x', true);
        $entity .= $this-&gt;matchHexNumber();
        $len = strlen($entity);
        if ($len &lt;= 3 || $len &gt; 7) {
            // Invalid entity, escape &amp;
            return htmlspecialchars($entity);
        }
        if ($this-&gt;look() === ';') {
            $entity .= $this-&gt;match(';');
        } else {
            $entity .= ';';
        }
        return $entity; 
    }

private function look() {
        return $this-&gt;input[ $this-&gt;pos ];
    }

private function lookMatches($str, $ignoreCase = true) {
        $input = substr($this-&gt;input, $this-&gt;pos, strlen($str));
        if ($ignoreCase) {
            $input = strtolower($input);
        }
        return $str === $input;
    }

private function matchAny() {
        return $this-&gt;input[ $this-&gt;pos++ ];
    }

private function match($char, $ignoreCase = false) {
        $input = $this-&gt;look();
        if ($ignoreCase) {
            $input = strtolower($input);            
        }
        if ($input !== $char) {
            // This means we have a logic coding error
            throw new Exception('Invalid match');
        }
        return $this-&gt;input[ $this-&gt;pos++ ];
    }

private function matches($str, $ignoreCase = false) {
        $input = substr($this-&gt;input, $this-&gt;pos, strlen($str));
        if ($ignoreCase) {
            $input = strtolower($input);
        }
        if ($str !== $input) {
            // This means we have a logic coding error
            throw new Exception('Invalid match');
        }
        $this-&gt;pos += strlen($str);
        return $str;
    }

private function matchUntil($char) {
        $match = '';
        while ($this-&gt;look() !== $char &amp;&amp; $this-&gt;pos &lt; $this-&gt;len) {
            $match .= $this-&gt;char();
        }
        return $match;
    }

private function matchWord() {
        $word = '';
        while (ctype_alpha($this-&gt;input[ $this-&gt;pos ]) &amp;&amp; $this-&gt;pos &lt; $this-&gt;len) {
            $word .= $this-&gt;input[ $this-&gt;pos++ ];
        }
        return $word;
    }

private function matchNumber() {
        $num = '';
        while (ctype_digit($this-&gt;input[ $this-&gt;pos ]) &amp;&amp; $this-&gt;pos &lt; $this-&gt;len) {
            $num .= $this-&gt;input[ $this-&gt;pos++ ];
        }
        return $num;
    }

private function matchHexNumber() {
        $num = '';
        while (ctype_xdigit($this-&gt;input[ $this-&gt;pos ]) &amp;&amp; $this-&gt;pos &lt; $this-&gt;len) {
            $num .= $this-&gt;input[ $this-&gt;pos++ ];
        }
        return $num;
    }

private function matchWhitespace() {
        $ws = '';
        while (ctype_space($this-&gt;input[ $this-&gt;pos ]) &amp;&amp; $this-&gt;pos &lt; $this-&gt;len) {
            $ws .= $this-&gt;input[ $this-&gt;pos++ ];
        }
        return $ws;
    }

private $pos; // Position in input
    private $len; // Length of input
    private $input;
    private $handler;
}

class HtmlFilter implements HtmlParserHandler {
    /**
     * Allowed tags
     */
    private $allowedTags = array('a', 'b', 'i', 'u', 'strong', 'em',
        'sub', 'sup', 'br', 'ul', 'ol', 'li', 'table', 'colgroup', 'col',
        'thead', 'tbody', 'tr', 'td', 'img');

/**
     * Attributes that are allowed
     */
    private $allowedAttributes = array(
        'a' =&gt; array('href'),
        'col' =&gt; array('width'),
        'td' =&gt; array('rowspan', 'colspan', 'bgcolor', 'align'),
        'img' =&gt; array('src', 'width', 'height', 'alt')
    );

/**
     * Tag stack is used to balance tags
     */
    private $tagStack = array();

/**
     * Tags which should always be self-closing (eg. &quot;&lt;img /&gt;&quot;)
     */
    private $selfCloseTags = array('img', 'br', 'col');

/**
     * Attributes which contain URLs, and should be checked for valid protocols
     */
    private $protocolAttributes = array('src', 'href');

/**
     * Protocols which are allowed
     */
    private $allowedProtocols = array('http');

/**
     * Should comments be removed?
     */
    private $stripComments = true;

private $output = ''; // Safe HTML

public function openTag($tagName, $attributes) {
        // Ignore tags that are not white listed
        if (!in_array($tagName, $this-&gt;allowedTags)) {
            return;
        }

array_push($this-&gt;tagStack, $tagName);
        $this-&gt;output .= '&lt;' . $tagName;
        $allowedAttributes = $this-&gt;allowedAttributes[$tagName];
        if (isset($allowedAttributes) &amp;&amp; is_array($allowedAttributes)) {
            foreach ($attributes as $name =&gt; $value) {
                if (in_array($name, $allowedAttributes)) {
                    // If its a protocol attribute, check if its an allowed protocol
                    if (in_array($name, $this-&gt;protocolAttributes)) {
                        foreach ($this-&gt;allowedProtocols as $protocol) {
                            $testOn = substr($value, 0, strlen($protocol));
                            if ($testOn === $protocol) {
                                $this-&gt;output .= ' ' . $name . '=&quot;' . $value . '&quot;';
                            }
                        }
                    } else {
                        $this-&gt;output .= ' ' . $name . '=&quot;' . $value . '&quot;';
                    }
                }
            }
        }
        if (in_array($tagName, $this-&gt;selfCloseTags)) {
            $this-&gt;output .= ' /';
        }
        $this-&gt;output .= '&gt;';
    }

public function closeTag($tagName) {
        if (!in_array($tagName, $this-&gt;tagStack)) {
            // Orphan close tag, ignore
            return;
        }
        while (true) {
            if (count($this-&gt;tagStack) === 0) {
                break;
            }
            $popTag = array_pop($this-&gt;tagStack);
            if ($popTag === $tagName) {
                break;
            }
            $this-&gt;output .= '&lt;/' . $popTag . '&gt;';
        }
        $this-&gt;output .= '&lt;/' . $tagName . '&gt;';
    }

public function comment($comment) {
        if ($this-&gt;stripComments) {
            return;
        }
        $this-&gt;output .= '&lt;!--' . $comment . '--&gt;';
    }

public function text($text) {
        $this-&gt;output .= $text;
    }

private $parser;
   
    public function __construct() {
        $this-&gt;parser = new HtmlParser;
    }

public function filter($html) {
        $this-&gt;parser-&gt;parse($html, $this);
        return $this-&gt;output;
    }
}

$filename = $argv[1];
$contents = file_get_contents($filename);

$filter = new HtmlFilter;
$safeHTML = $filter-&gt;filter($contents);

// Compress html
//$safeHTML = preg_replace('/\s+/', ' ', $safeHTML);

echo $safeHTML . &quot;\n&quot;;</pre>
<a href="http://www.refactormycode.com/codes/557-html-filter" style="color:#fff" title="As seen on RefactorMyCode.com"><img alt="Small_logo" src="http://www.refactormycode.com/images/small_logo.gif" style="border:0" /></a>

Refactor :my => 'code'

Recent

Popular

Pastable version of HTML Filter