(转)过滤在线编辑器产生的不安全html代码

过滤在线编辑器产生的不安全html代码
<?php  
  /**  
    *   过滤在线编辑器产生的不安全html代码.  
    *  
    *   PHP   versions   4   and   5  
    *  
    *   @copyright         版权所无，任意传播.  
    *   @link                   http://www.52sunny.net  
    *   @name                   html过滤    
    *   @version             v   0.0.10  
    *   @author               Lucklrj   ([e-mail],qq:7691272)  
    *   @lastmodified   2006-06-09   10:42   (Tue,   2006-06-09)    
    *   @notice               此版本只过滤js,框架，表单。  
                                    作者能力有限，使用本程序若产生任何安全问题，与本人无关。  
    欢迎来信与我交流。  
    */  
  $str="<tr><td   bgcolor=''#FFFFFF''>  
  <div   style=''url(123.offsetWidth)>";  
  //$str="url(javascript:x)";  
   
  /*不需要过滤的数组*/  
  $htm_on=array(  
  "<acronym","acronym>",  
  "<baseFont","baseFont>",  
  "<button","button>",  
  "<caption","caption>",  
  "<clientInformation","clientInformation>",  
  "<font","font>",  
  "<implementation","implementation>",  
  "<button","button>",  
  "<location","location>",  
  "<option","option>",  
  "<selection","selection>",  
  "<strong","strong>");  
   
  $htm_on_uper=array(  
  "<ACRONYM","span>ACRONYM>",  
  "<BASEFONT","BASEFONT>",  
  "<BUTTON","BUTTON>",  
  "<CAPTION","CAPTION>",  
  "<CLIENTINFORMATION","CLIENTINFORMATION>",  
  "<FONT","FONT>",  
  "<IMPLEMENTATION","IMPLEMENTATION>",  
  "<BUTTON","BUTTON>",  
  "<LOCATION","LOCATION>",  
  "<OPTION","OPTION>",  
  "<SELECTION","SELECTION>",  
  "<STRONG","STRONG>");  
 
  /*字符格式*/  
  $str=strtolower($str);  
  $str=preg_replace("/s+/",   "   ",   $str);//过滤回车  
  $str=preg_replace("/   +/"an style="COLOR: #000000">,   "   ",   $str);//过滤多个空格
 
  /*过滤/替换几种形式的js*/  
  $str=preg_replace("/<(script.*?)>(.*?)<(/script.*?)>/si","",$str);//删除<script>。。。</script>格式，  
  //$str=preg_replace("/<(script.*?)>(.*?)<(/script.*?)>/si","&lt;\1&gt;\2&lt;\3&gt;",$str);//替换为可以显示的，  
   
  $str=preg_replace("/<(script.*?)>/si","",$str);//删除<script>未封闭  
  //$str=preg_replace("/<(script.*?)>/si","&lt;\1&gt;",$str);//替换未封闭  
   
  /*删除/替换表单*/  
  $str=preg_replace("/<(/?form.*?)>/si","",$str);//删除表单  
  //$str=preg_replace("/<(/?form.*?)>/si","&lt;\1&gt;",$str);//替换表单  
   
  $str=preg_replace("/<(i?frame.*?)>(.*?)<(/i?frame.*?)>/si","",$str);//删除框架  
  //$str=preg_replace("/<(i?frame.*?)>(.*?)<(/i?frame.*?)>/si","&lt;\1&gt;\2&lt;\3&gt;",$str);//替换框架  
   
  /*过滤on事件*/  
  $str=preg_replace("/href=(.+?)(["|''|   |>])/ie","''href=''.strtoupper(''\1'').''\2''",$str);//把href=涉及到的on转换为大写。  
  $str=str_replace($htm_on,$htm_on_uper,$str);//把<font,font>换为大写, dhtml标签字符，正则判断太烦琐，采用转换办法。  
 
  $str=preg_replace("/(on[^   .<>]+?)([   |>])/s","\2",$str);//取掉on事件  
   
  /*过滤超级连接的js*/  
  $str=preg_replace("/(href|src|background|url|dynsrc|expression|codebase)[=:(]([   "'']*?w+..*?|javascript|vbscript:[^>]*?)()?)([   >/])/si","\1=''#''   \3\4",$str);//取掉href=javascript:  
   
  //返回小写字符  
  $str=strtolower($str);  
  $str=str_replace("&","&#x26;",$str);
   
echo   $str;  
  ?>