Stripping ONLY php from a page, not stripping html. [Archive]

View Full Version : Stripping ONLY php from a page, not stripping html.

mouseattack

08-24-2005, 06:18 PM

Hi guys,
I'm trying to learn how to strip all PHP from a page.

My alogrithm so far is to strip EVERYTHING between <? and ?>

Will that work? Are there any ways someone can still run a php code if I strip those tags and EVERYTHING between them.

Next, would someone who know's regular expressions, be so kind as to tell me how to make a WILDCARD unlimited characters long, until it reaches the ?> please.

Thanks.

I just want to strip from <? ANYTHING IN HERE ?>

Thanks again.

innova

08-24-2005, 07:14 PM

Are you worried about people submitting php code in form fields or something that effect?

And you still want to let them put in <html> tags or even <script> tags for that matter?

Probably best to just use php's strip_tags function and make the blanket statement :)

mouseattack

08-24-2005, 07:48 PM

nope. tried that function, i need the eregi_replace() syntax for this.

I MUST include a page, from a remote location (i have permission and it is something I MUST do to meet requirements, but I do not like putting up remote include's on my site to someone else's site that I do NOT trust) So I am trying to make it so ONLY html will show up, and they can't insert "bad" php code to try to hack me.

GideonX

08-25-2005, 03:35 PM

Maybe this will work:

$string = eregi_replace( "<?php[^>]*?>", "", $string);

That 'should' replace everything between <?php and ?> with "".

Not tested, but might give you a good idea on how to start.