Posted by pittendrigh on 07/19/06 14:19

I have a forum where all user-supplied text
(posted to the forum) is cleaned with htmlentities($msg) before sending

it back to incoming GET requests.

I want to allow image uploads to registered users.
That much (allowing uploads if registered) is straightforward.

But if all my user-supplied output is scrubbed with htmlentities
first, then the img tags aren't tags, and no image will show.

How do forums (that do allow image uploads) deal with this?
Do they leave user-supplied text unchecked? Or use some
sort of a regular expression to scrub everything inside
user-supplied text except the image tags?

[Back to original message]