New PHP script: any security issues?
Posted: 2008-08-06 04:09pm
I just created a PHP script, mostly for my own use (although anybody can you use it if you like), which converts HTML formatted pages to BBcode. I made it because I hate the way copying and pasting from the web browser often butchers the shit out of a webpage, especially with all kinds of unnecessary line-breaks. I used to have a tutorial for doing this in the Announcements area, but that involved creating your own *nix script so it was a pretty big PITA for most users, and a web-based conversion utility is much simpler.
The question is: is there anything I should be concerned about, security wise? It's a pretty simple script so I can't see how something could go wrong, but I'm no security expert:
http://bbs.stardestroyer.net/html2bbcode.php";
// Special characters not processed by html_entity_decode
$pattern[]="/—|–|–|—/";
$replacement[]="-";
$pattern[]="/“|”|"|“|”/";
$replacement[]="\"";
$pattern[]="/’|‘|'|‘|’/";
$replacement[]="'";
// Acquire data
if (isset($_POST['htmlsource']))
{
// Read in data but remove line feeds and carriage returns
$htmlsource=ereg_replace("/\n|\r|\r\n|\n\r/"," ",$_POST['htmlsource']);
// Perform HTML substitution to BBcode
$htmlsource=preg_replace($pattern,$replacement,html_entity_decode($htmlsource));
// Eliminate all remaining HTML tags
$htmlsource=preg_replace("/<.*?>/","",$htmlsource);
// Replace remaining newlines with <br /> tags for output
$htmlsource=preg_replace("/\n/","<br />",htmlspecialchars($htmlsource));
// Output results
echo "<html>\n<body>\n".$htmlsource."\n</body>\n</html>\n";
}
else
{
?>
<html>
<body>
<h1 style="text-align:center">HTML Source to BB Code Converter</h1>
<p>Copy and paste the HTML source code into this text box:</p>
<form action="<?$_SERVER['PHP_SELF']?>" method="post">
<textarea rows="20" cols="80" name="htmlsource"></textarea><br />
<input type="submit" value="Submit" /><input type="reset" />
</form>
</body>
</html>
<?
}
?>[/code]
The question is: is there anything I should be concerned about, security wise? It's a pretty simple script so I can't see how something could go wrong, but I'm no security expert:
http://bbs.stardestroyer.net/html2bbcode.php
Code: Select all
<?
// HTML to BBCode Converter
// Set search/replace variables
unset($pattern);
unset($replacement);
// Eliminate whitespace
$pattern[]="/ [ |\t]+/";
$replacement[]=" ";
// Images (note that .*? is an ungreedy version of .*)
$pattern[]="/<IMG.*?SRC.*?\"(.*?)\".*?>/i";
$replacement[]="[img]\\1[/img]";
// Links
$pattern[]="/<A.[^>]*HREF[^\"]*\"([^\"]*)\".*?>(.*?)<\/A>/i";
$replacement[]="[url=\\1]\\2[/url]";
// Forms
$pattern[]="/<FORM.*?<\/FORM>/i";
$replacement[]="";
// Floats
$pattern[]="/<DIV[^>]*FLOAT.*?>.*?<\/DIV>/i";
$replacement[]="";
// Paragraph structure
$pattern[]="/<P.*?>|<\/P>|<DIV.*?>|<\/DIV>|<BR.*?>|<\/TD>/i";
$replacement[]="\n";
$pattern[]="/<BLOCKQUOTE>/i";
$replacement[]="[quote]";
$pattern[]="/<BLOCKQUOTE[^>]*CITE=\"(.*?)\".*?>/i";
$replacement[]="[quote=\"\\1\"]";
$pattern[]="/</BLOCKQUOTE>/i";
$replacement[]="[/quote]";
// Miscellaneous HTML codes
$pattern[]="/<I>|<I .*?>/i";
$replacement[]="[i]";
$pattern[]="/<\/I>/i";
$replacement[]="[/i]";
$pattern[]="/<B>|<B .*?>/i";
$replacement[]="[b]";
$pattern[]="/<\/B>/i";
$replacement[]="[/b]";
$pattern[]="/<U>|<U .*?>/i";
$replacement[]="[u]";
$pattern[]="/<\/U>/i";
$replacement[]="[/u]";
$pattern[]="/<H1.*?>/i";
$replacement[]="\n[b][size=24]";
$pattern[]="/<\/H1>/i";
$replacement[]="[/size][/b]\n";
$pattern[]="/<H2.*?>/i";
$replacement[]="\n[b][size=20]";
$pattern[]="/<\/H2>/i";
$replacement[]="[/size][/b]\n";
$pattern[]="/<H3.*?>/i";
$replacement[]="\n[b][size=16]";
$pattern[]="/<\/H3>/i";
$replacement[]="[/size][/b]\n";
$pattern[]="/<OL.*?>/i";
$replacement[]="[list=1]";
$pattern[]="/<UL.*?>/i";
$replacement[]="[list]";
$pattern[]="/<\/OL>|<\/UL/i";
$replacement[]="[/list]";
$pattern[]="/<LI.*?>/i";
$replacement[]="[*]";
$pattern[]="/<PRE>/i";
$replacement[]="[code]";
$pattern[]="/<\/PRE>/i";
$replacement[]="// Special characters not processed by html_entity_decode
$pattern[]="/—|–|–|—/";
$replacement[]="-";
$pattern[]="/“|”|"|“|”/";
$replacement[]="\"";
$pattern[]="/’|‘|'|‘|’/";
$replacement[]="'";
// Acquire data
if (isset($_POST['htmlsource']))
{
// Read in data but remove line feeds and carriage returns
$htmlsource=ereg_replace("/\n|\r|\r\n|\n\r/"," ",$_POST['htmlsource']);
// Perform HTML substitution to BBcode
$htmlsource=preg_replace($pattern,$replacement,html_entity_decode($htmlsource));
// Eliminate all remaining HTML tags
$htmlsource=preg_replace("/<.*?>/","",$htmlsource);
// Replace remaining newlines with <br /> tags for output
$htmlsource=preg_replace("/\n/","<br />",htmlspecialchars($htmlsource));
// Output results
echo "<html>\n<body>\n".$htmlsource."\n</body>\n</html>\n";
}
else
{
?>
<html>
<body>
<h1 style="text-align:center">HTML Source to BB Code Converter</h1>
<p>Copy and paste the HTML source code into this text box:</p>
<form action="<?$_SERVER['PHP_SELF']?>" method="post">
<textarea rows="20" cols="80" name="htmlsource"></textarea><br />
<input type="submit" value="Submit" /><input type="reset" />
</form>
</body>
</html>
<?
}
?>[/code]
