HTML Brain Teaser

[zetetic]

I recently enabled HTML in posts on my forum, but only for members of the "Can use HTML" group. (Thanks to this handy hack.)

And one of my users immediately found a little bug. By putting:

<!--

in a post, he was able to screw up the postbit so bad the reply buttons were all gone and such. To prevent it, I tried all these tags after $post[message] in the postbit template:

<!-- comment -->
<!-- -->
<!---->
-->

But the first three had no effect (they just got commented out with everything else from the opening comment tag in the post) and the last one just showed up at the end of every post.

Can you think of a solution to this? (Besides disabling HTML )

[DRJ]

a) disable html.
b) only allow members that will not #$%# up your board to use html.
c) when b fails, refer to a.

[zetetic]

Originally Posted by DRJ

a) disable html.

See the words preceding the tongue out smilie. HTML is a powerful tool that (used properly) can dramatically improve the aesthetic quality of a forum.

Disabling it is not an option!

b) only allow members that will not #$%# up your board to use html.

There will always be people who are malicious, clueless or careless. I think the answer is to try to make the software foolproof, not cripple it.

c) when b fails, refer to a.

So you don't know how to fix it, eh?

[Paul M]

Adding <!-- to the swear censor might work - I haven't tested it.

[Zachery]

Originally Posted by Paul M

Adding <!-- to the swear censor might work - I haven't tested it.

IF you don't want users messing up your page layout, stop letting them use html, period.

[DRJ]

I am sorry I do not know a 100% fix. And you will run into more problems then just the <!--.

What you need to do is create bb code to allow certain html tags to be used.

[kall]

The whole idea of not allowing HTML is to prevent precisely what you have had happen.

There's no way around it. If you allow it, you have to limit it..and that defeats the purpose of allowing it.

[zetetic]

Originally Posted by Paul M

Adding <!-- to the swear censor might work - I haven't tested it.

Ooo... now that's a good idea. Unfortunately I use this user optional word censor hack in place of the regular word censor, so that won't work for me. But thanks for giving it some thought.

Originally Posted by kall

The whole idea of not allowing HTML is to prevent precisely what you have had happen.

There's no way around it. If you allow it, you have to limit it..and that defeats the purpose of allowing it.

What makes completely removing it better than limiting it? I already limit it by restricting it to people who are in a specific group. And you're right, if I have to limit it a lot more than that I might as well not enable it at all.

I have to say... I've seen all the discussion around here and at vb.com over the years about how nobody should ever enable HTML under any circumstance ever ever ever, and it really makes me wonder why Jelsoft hasn't just removed the functionality from vBulletin.

But even if they did, I'd find a way to hack it back in.

[kobescoresagain]

could you somehow put --> somewhere. that way they would cancel each other out?

[zetetic]

Originally Posted by kobescoresagain

could you somehow put --> somewhere. that way they would cancel each other out?

I thought I could, but unfortunately if you put that right after $post[message] in the postbit template it shows up in every post. Hmm... maybe I can put it within a comment though. I wonder what effect something like <!-- --> --> might have. I'll keep playing around.

ETA: Well I'll be damned. That seems to work!

Oops, no it doesn't.