php过滤html标记属性类(附源码)

3. /** HTML Attribute Filter

4. * Date: 2013-09-22
5. * Author: fdipzone
6. * ver: 1.0
7. * edit: bbs.it-home.org
8. * Func:
9. * public strip 过滤属性
10. * public setAllow 设置允许的属性
11. * public setException 设置特例
12. * public setIgnore 设置忽略的标记
13. * private findElements 搜寻需要处理的元素
14. * private findAttributes 搜寻属性
15. * private removeAttributes 移除属性
16. * private isException 判断是否特例
17. * private createAttributes 创建属性
18. * private protect 特殊字符转义
19. */
21. class HtmlAttributeFilter{ // class start
23. private $_str = ''; // 源字符串
24. private $_allow = array(); // 允许保留的属性 例如:array('id','class','title')
25. private $_exception = array(); // 特例 例如:array('a'=>array('href','class'),'span'=>array('class'))
26. private $_ignore = array(); // 忽略过滤的标记 例如:array('span','img')
28. /** 处理HTML,过滤不保留的属性
29. * @param String $str 源字符串
30. * @return String
31. */
32. public function strip($str){
33. $this->_str = $str;
35. if(is_string($this->_str) && strlen($this->_str)>0){ // 判断字符串
37. $this->_str = strtolower($this->_str); // 转成小写
39. $res = $this->findElements();
40. if(is_string($res)){
41. return $res;
42. }
43. $nodes = $this->findAttributes($res);
44. $this->removeAttributes($nodes);
45. }
47. return $this->_str;
48. }
50. /** 设置允许的属性
51. * @param Array $param
52. */
53. public function setAllow($param=array()){
54. $this->_allow = $param;
55. }
57. /** 设置特例
58. * @param Array $param
59. */
60. public function setException($param=array()){
61. $this->_exception = $param;
62. }
64. /** 设置忽略的标记
65. * @param Array $param
66. */
67. public function setIgnore($param=array()){
68. $this->_ignore = $param;
69. }
71. /** 搜寻需要处理的元素 */
72. private function findElements(){
73. $nodes = array();
74. preg_match_all("/<([^ !\/\>\n]+)([^>]*)>/i", $this->_str, $elements);
75. foreach($elements[1] as $el_key => $element){
76. if($elements[2][$el_key]){
77. $literal = $elements[0][$el_key];
78. $element_name = $elements[1][$el_key];
79. $attributes = $elements[2][$el_key];
80. if(is_array($this->_ignore) && !in_array($element_name, $this->_ignore)){
81. $nodes[] = array('literal'=>$literal, 'name'=>$element_name, 'attributes'=>$attributes);
82. }
83. }
84. }
86. if(!$nodes[0]){
87. return $this->_str;
88. }else{
89. return $nodes;
90. }
91. }
94. /** 搜寻属性
95. * @param Array $nodes 需要处理的元素
96. */
97. private function findAttributes($nodes){
98. foreach($nodes as &$node){
99. preg_match_all("/([^ =]+)\s*=\s*[\"|']{0,1}([^\"']*)[\"|']{0,1}/i", $node['attributes'], $attributes);
100. if($attributes[1]){
101. foreach($attributes[1] as $att_key=>$att){
102. $literal = $attributes[0][$att_key];
103. $attribute_name = $attributes[1][$att_key];
104. $value = $attributes[2][$att_key];
105. $atts[] = array('literal'=>$literal, 'name'=>$attribute_name, 'value'=>$value);
106. }
107. }else{
108. $node['attributes'] = null;
109. }
110. $node['attributes'] = $atts;
111. unset($atts);
112. }
113. return $nodes;
114. }
116. /** 移除属性
117. * @param Array $nodes 需要处理的元素
118. */
119. private function removeAttributes($nodes){
120. foreach($nodes as $node){
121. $node_name = $node['name'];
122. $new_attributes = '';
123. if(is_array($node['attributes'])){
124. foreach($node['attributes'] as $attribute){
125. if((is_array($this->_allow) && in_array($attribute['name'], $this->_allow)) || $this->isException($node_name, $attribute['name'], $this->_exception)){
126. $new_attributes = $this->createAttributes($new_attributes, $attribute['name'], $attribute['value']);
127. }
128. }
129. }
130. $replacement = ($new_attributes) ? "<$node_name $new_attributes>" : "<$node_name>";
131. $this->_str = preg_replace('/'.$this->protect($node['literal']).'/', $replacement, $this->_str);
132. }
133. }
135. /** 判断是否特例
136. * @param String $element_name 元素名
137. * @param String $attribute_name 属性名
138. * @param Array $exceptions 允许的特例
139. * @return boolean
140. */
141. private function isException($element_name, $attribute_name, $exceptions){
142. if(array_key_exists($element_name, $this->_exception)){
143. if(in_array($attribute_name, $this->_exception[$element_name])){
144. return true;
145. }
146. }
147. return false;
148. }

149. /** 创建属性

150. * @param String $new_attributes
151. * @param String $name
152. * @param String $value
153. * @return String
154. */
155. private function createAttributes($new_attributes, $name, $value){
156. if($new_attributes){
157. $new_attributes .= " ";
158. }
159. $new_attributes .= "$name=\"$value\"";
160. return $new_attributes;
161. }
163. /** 特殊字符转义
164. * @param String $str 源字符串
165. * @return String
166. */
167. private function protect($str){
168. $conversions = array(
169. "^" => "\^",
170. "[" => "\[",
171. "." => "\.",
172. "$" => "\$",
173. "{" => "\{",
174. "*" => "\*",
175. "(" => "\(",
176. "\\" => "\\\\",
177. "/" => "\/",
178. "+" => "\+",
179. ")" => "\)",
180. "|" => "\|",
181. "?" => "\?",
182. "<" => "\<",
183. ">" => "\>"
184. );
185. return strtr($str, $conversions);
186. }
188. } // class end
190. ?>

2，演示示例

2. require('HtmlAttributeFilter.class.php');
4. $str = '
   • yuna

     love

     want to knowYES
   ';
6. $obj = new HtmlAttributeFilter();
8. // 允许id属性
9. $obj->setAllow(array('id'));
11. $obj->setException(array(
12. 'a' => array('href'), // a 标签允许有 href属性特例
13. 'ul' => array('class') // ul 标签允许有 class属性特例
14. ));
16. // img 标签忽略,不过滤任何属性
17. $obj->setIgnore(array('img'));
19. echo 'source str:
    ';
20. echo htmlspecialchars($str).'
    
    ';
21. echo 'filter str:
    ';
22. echo htmlspecialchars($obj->strip($str));
23. ?>

附，php 过滤html标记属性类的源码下载地址