I have a piece of code that allows for
BB-Code and replaces it with
It takes two precautions to prevent XSS.
- It replaces '<','>' and '"' using a simple str_replace
Since browsers decode the attribute value before further interpreting it, you can get around the regex check by encoding the URL using : [url]j ... [/url]
So I get:
Long story made short: I want more than a steenkin attribute tage (who would click a link looking like that?!)
Can I somehow encode my '"' '<' etc. so it won't be replaced by the str_replace but still be interpreted in the context of HTML.