Skip to main content
gamedev.net
🔒 Locked

[web] BBCode in PHP

Started by krez May 27, 2009 at 5:26 PM 11 replies 3.5k views
Original Post
krez
krez
Does anyone know of a good BBCode parser for PHP? I have been poking around the internet for a while now and keep finding something wrong with the ones I have tried out. It looks like I'm going to have to hack away at one of them to try and fix the problems, but I'd rather have something that just works. I mean, tons of websites use BBCode, where did they get their implementations from?
--- krez ([email="krez_AT_optonline_DOT_net"]krez_AT_optonline_DOT_net[/email])
leiavoia
leiavoia
2 points for you:

- BBCode is lame. Use richtext! You would be surprised how insanely easy it is to get this thing up and running:

FCKEditor

I've tried a few of them, and liked this one the best. It's fast, light, and doesn't come with a lot of glop. It also puts out correct XHTML (big plus!)

- If you are bent on BBCode, try this one. I have a hacked version with a few additional features added too, if you are interested.

phresnel
phresnel
Of course you could also lookup the sourcecode of software that uses BBCode. The one used by phpBB for example should also be capable of bbcode with arguments (example: we once had a tag that goes like [img width=512]img.jpg[/img] on ompf.org).
krez
krez
Quote:
Original post by leiavoia
BBCode is lame. Use richtext!

That is cool as hell. But I think it is extreme overkill for what I am doing (I just want to allow a bit of formatting to users, hyperlinks, etc).
Quote:
If you are bent on BBCode, try this one. I have a hacked version with a few additional features added too, if you are interested.

Thanks I'll look into it.
Quote:
Original post by Sander
There are two Pear libraries who can do that: HTML_BBCodeParser and Text_Wiki_BBCode.

HTML_BBCodeParser is the one I have most recently played with, but it apparently has some bugs that have been open for QUITE a while. I'd rather not have to mess with it too much, but also I don't want to leave the opportunity for some random internet idiot to inject &#106avascript into my site. The Wiki one is very early alpha.<br/><!--QUOTE--><blockquote><span class="smallfont">Quote:</span><table border="0" cellpadding="4" cellspacing="0" width="95%"><tr><td class="quote"><!--/QUOTE--><!--STARTQUOTE--><i>Original post by phresnel</i><br/>Of course you could also lookup the sourcecode of software that uses BBCode. The one used by phpBB for example should also be capable of bbcode with arguments (example: we once had a tag that goes like [img width=512]img.jpg[/img] on ompf.org).<!--QUOTE--></td></tr></table></blockquote><!--/QUOTE--><!--ENDQUOTE--><br/>I might have to, but I thought there might be a good one already packaged up for me to download and forget about.<br/><br/>Thanks all of you!
--- krez ([email="krez_AT_optonline_DOT_net"]krez_AT_optonline_DOT_net[/email])
sirGustav
sirGustav
Quote:
Original post by krez
Quote:
Original post by leiavoia
BBCode is lame. Use richtext!

That is cool as hell. But I think it is extreme overkill for what I am doing (I just want to allow a bit of formatting to users, hyperlinks, etc).


Did you try the basic layout?
phresnel
phresnel
Quote:
Original post by krez
Quote:
Original post by phresnel
Of course you could also lookup the sourcecode of software that uses BBCode. The one used by phpBB for example should also be capable of bbcode with arguments (example: we once had a tag that goes like [img width=512]img.jpg[/img] on ompf.org).

I might have to, but I thought there might be a good one already packaged up for me to download and forget about.


Of course there's a chance that phpBB themselves use a third party library. If you can invest some 30 minutes or so, you should be able to find the answer. Last time I checked, the sourcecode was okay to navigate :)
leiavoia
leiavoia
Quote:
Original post by krez
Quote:
Original post by leiavoia
BBCode is lame. Use richtext!

That is cool as hell. But I think it is extreme overkill for what I am doing (I just want to allow a bit of formatting to users, hyperlinks, etc).


No, that's exactly what it's for. FCKeditor lets you configure what options you want available. You can make it really over-the-top or very simple. If all you want is B, I, U, and LINK, you can do that.

See here for example

I would urge you to take a second look. It's too simple to pass up!
Feralrath
Feralrath
Here is some code I found around the net a while ago, fixed up and incorporated into a project.

I haven't used it in a while because as leiavoia said I've switched to rich text editor (tho I normally use tinymce because I'm most familiar with it and like the plugin capability.) But it does work and is setup for most of the basic bbcode. If you are familiar with regular expressions then you can easily expand it to any tag you can think of.

//bbcode and smiliesfunction bbcode ($str) {    $str = htmlentities($str);    $token = array(                "'\[b\](.*?)\[/b\]'is",                                                  '/\[i\](.*?)\[\/i\]/is',                                                '/\[u\](.*?)\[\/u\]/is',       				'/\[url\=http:\/\/(.*?)](.*?)\[\/url\]/is',                                         '/\[url\=(.*?)\](.*?)\[\/url\]/is',                                         '/\[url\](.*?)\[\/url\]/is',                                             '/\[align\=(left|center|right)\](.*?)\[\/align\]/is',                    '/\[img\](.*?)\[\/img\]/is',                                            '/\[mail\=(.*?)\](.*?)\[\/mail\]/is',                                    '/\[mail\](.*?)\[\/mail\]/is',                                            '/\[font\=(.*?)\](.*?)\[\/font\]/is',                                    '/\[size\=(.*?)\](.*?)\[\/size\]/is',                                    '/\[color\=(.*?)\](.*?)\[\/color\]/is',                        );    $tokenized = array(                '$1',                '$1',                '$1',				'$2',                '$2',                '$1',                '
$2
', '<img src="$1" />', '$2', '$1', '$2', '$2', '$2', ); // Do simple BBCode's $str = preg_replace ($token, $tokenized, $str); // Do <blockquote> BBCode $str = embedded ($str); return $str;}function embedded ($str) { $open = '<blockquote>'; $close = '</blockquote>'; // How often is the open tag? preg_match_all ('/\[quote\]/i', $str, $matches); $opentags = count($matches['0']); // How often is the close tag? preg_match_all ('/\[\/quote\]/i', $str, $matches); $closetags = count($matches['0']); // Check how many tags have been unclosed // And add the unclosing tag at the end of the message $unclosed = $opentags - $closetags; for ($i = 0; $i < $unclosed; $i++) { $str .= '</blockquote>'; } // Do replacement $str = str_replace ('[' . 'quote]', $open, $str); $str = str_replace ('[/' . 'quote]', $close, $str); return $str;}
Magos
Magos
But WYSIWYG's produces html-code, which could be abused if you're not careful. You'd have to implement a server-side verification of the generated html, which would be a lot tougher than verifying the simpler BBCode.
----------------------------------------MagosX.com
krez
krez
Well, leiavoia, you have convinced me (and thank you).

Magos, that's what I was thinking originally also, but BBCode is always translated into HTML anyway, and it would seem that any BBCode implementations have bugs (or oversights, or call it "somebody-else's-problem") that would allow XSS or other security issues anyway.

HTMLPurifier seems to be the answer for that, and if I have to verify the generated HTML anyway, the nifty beautiful interface wins.
--- krez ([email="krez_AT_optonline_DOT_net"]krez_AT_optonline_DOT_net[/email])
Magos
Magos
Quote:
Original post by krez
but BBCode is always translated into HTML anyway


BBCode is translated on the server (safe(r)), while WYSIWYGS translate on the client (unsafe).
----------------------------------------MagosX.com
krez
krez
Quote:
Original post by Magos
BBCode is translated on the server (safe(r)), while WYSIWYGS translate on the client (unsafe).

The way I see it, I'm going to have to clean the input anyway. I don't see how client-translated HTML is any worse or less safe than server-translated BBCode, since either could be malicious (sure with BBCode there are a few more hoops to jump through to try something evil, but bugs do exist). Also all of the BBCode implementations I have found have their own little quirks, whereas HTML is standardized (and the users would be using an editor mostly anyway (and HTMLPurifier will clean up sloppy non-malicious HTML too)).

I could be missing something, can you give me more detail about why it is less safe to allow raw HTML to be submitted, assuming it is going through a clean-up filter?
--- krez ([email="krez_AT_optonline_DOT_net"]krez_AT_optonline_DOT_net[/email])

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.

Sign in to reply to this topic.